Submission Details
Severity:
Random numbers are generated in a predictable way.
Summary
Random numbers are generated in MysteryBox::openBoxin a weak and predictable way. Therefore, a user can predict what is in his box and consistently get the desired reward each time he opens his box.
Vulnerability Details
The random number is generated by hashing block.timestamp and wallet address of the caller as shown below. Both values are deterministics, predictable and publicly available data. Anyone can predict the random number.
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;
Impact
A user can consistently get the Gold Coin since he can predict it.
Tools Used
Manual review
Recommendations
Use Chainlink VRF random number generator to generate random numbers.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.