Submission Details
Severity:
Weak randomness In the `openBox` function.
Summary
The function is using a week random value. The block.timestamp is susceptible on manipulation by a validator's administrator. It is quite easy to prepare request for the highest reward rewardsOwned[msg.sender].push(Reward("Gold Coin", 1 ether)).
Vulnerability Details
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;
Impact
Here weak randomValue can be use to select the highest Reward in openBox function
Tools Used
Foundry
Recommendations
Better use oracle for that like Chainlink's VRF or similar well auditing solution.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.