Summary

In MysteryBox.sol:openBox function on line 48 the there is a randomness that is weak and can be potentially guessed.

Vulnerability Details

When you are taking the keccack256 of a block.timestamp and msg.sender you are able to maniuplate the possible results by either calculating a specific time to win the prize you want or by changing the msg.sender until you get the results that you want.

Impact

Impact is that users may be able to get Gold Coin on every play if they are running calculations.

Tools Used

Manual Review

Recommendations

Take the randomness off chain using something like the Chainlink **Verifiable Random Function. **