Mystery Box

Summary:

An adversarial player can choose the rarity of an opened box by manipulating the block.timestamp value of the block in which the box is opened.

Vulnerability Details:

The MysteryBox::openBox function uses block.timestamp as a source of randomness, hashing the timestamp packed
with the player's wallet, defined as the msg.sender, both of these values are public and are not a provably fair source of randomness.

Relevant Link:

https://github.com/Cyfrin/2024-09-mystery-box/blob/281a3e35761a171ba134e574473565a1afb56b68/src/MysteryBox.sol#L47

Reference:

In Slither's documentation it is recommended to not use block.timestamp, now or blockhash as a source of randomness due to their public and manipulable nature.

Impact:

Critical.

Tools Used:

Manual review, Slither.

Recommendations:

Using a provably fair oracle as a source of randomness, a widely used, decentralized example is Chainlink VRF.