Submission Details
Severity:
Weak random number generation in openBox
Summary
The openBox function uses block.timestamp and msg.sender to generate a "random" number, which is vulnerable to manipulation by miners or adversarial users, as these values can be influenced or predicted.
Vulnerability Details
Impact
The random number is predictable due to weak entropy sources.
Tools Used
manual review
Recommendations
While true randomness is difficult to achieve on-chain, you can improve randomness by incorporating more unpredictable inputs like block.difficulty or an external randomness oracle such as Chainlink VRF
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, block.difficulty, msg.sender))) % 100;
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.