Submission Details
Severity:
Weak source of randomness in `MysteryBox::openBox`
Summary
`block.timestamp` together with `msg.sender` together they create a predicatble number. Predicatble number is not a good random number.
Vulnerability Details
Impact
User/Miner can predict the result of `uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100`; therefore can win the Gold coin or another rare item.
Tools Used
Manual Review
Recommendations
Do not use block.timestamp as a source of randomness
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.