Submission Details
Severity:
randomness manipulation
Summary
Vulnerability Details
https://github.com/Cyfrin/2024-09-mystery-box/blob/main/src/MysteryBox.sol#L47
Since block.timestamp and msg.sender are publicly accessible values, they can be predicted by buyers or miners, making the randomness vulnerable to manipulation.
Impact
randomness can be manipulated by buyers to get higher random values
Tools Used
consider using Chainlink VRF (Verifiable Random Function)
Recommendations
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.