Mystery Box

Summary

Hashing msg.sender, block.timestamp together creates a predictable final number. A predictable number is not a good random number. Malicious users can manipulate these values or know them ahead of time to choose the winner of the Gold Coin Mystery Box themselves.

Vulnerability Details

There are few attack vectors here:

1. validators can know ahead of time the block.timestamp and use that knowledge to predict when to MysteryBox::openBox.

2. Users can manipulate the msg.sender value to result in their index being the winner.

Impact

Any user can choose the number 99, winning the Gold Coin essentially making it such that all the rewards have the same rarity, since you can choose the reward.

Tools Used

VsCode, foundry

Recommendations

Consider using an oracle for your randomness like Chainlink VRF.