Submission Details
Severity:
[EVMN] Pseudo-random Prone To Precalculation
Summary
Generating a random value from on-chain information allows a user to pre-calculate a preferable value for them.
Vulnerability Details
The code on line 47 below is prone to user pre-calculation.
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;
A user can pre-calculate the randomValue to get the number they prefer before calling function openBox(). The user can either time their function call or use the right sender address.
Impact
The randomValue can be guessed so the user always gets the maximum reward.
Tools Used
Manual review.
Recommendations
Consider using a verifiable random function (VRF) service to generate a random value.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.