Mystery Box

Summary

The random value is generated using block.timestamp and msg.sender. This is not secure and can be exploited. Miners can manipulate the block.timestamp, and attackers could potentially make multiple transactions or use different addresses to influence the outcome. This weak randomness can lead to predictable outcomes, allowing users or miners to manipulate the rewards.

Vulnerability Details

MysteryBox.sol/Line47

Impact

Miners or attackers could influence the random value and increase their chances of getting higher rewards (Gold or Silver coins).

Tools Used

Foundry

Recommendations

Use a more secure source of randomness like Chainlink VRF (Verifiable Random Function) to ensure unpredictable outcomes.