Mystery Box

Description: Hashing msg.sender and block.timestamp together creates a predictable final number. A predictable number is not a good random number. Malicious users can manipulate the values or know them ahead of time.

This means that the users can predict the randomValue ahead of time and can choose the right moment to open the box for maximum reward.

Impact: Any user can generate the randomness ahead of time and identify a suitable time to open the box for maximum reward. Alternatively, they can

Proof of Concept:

1. Validators/users can know ahead of time the block.timestamp and use that to predict when to open the mystery box.

2. User can mine/manipulate their msg.sender value to result in this address being used to open the box for maximum reward.

Using on-chain values as a randomness seed is a well-documented attack vector in the blockchain space.

Recommended Mitigation: Consider using a cryptographically provable random number generator such as Chainlink VRF.