Summary

This line of code uses block.timestamp for random number to select the reward.

Vulnerability Details

https://github.com/Cyfrin/2024-09-mystery-box/blob/281a3e35761a171ba134e574473565a1afb56b68/src/MysteryBox.sol#L47

Impact

Miner can use this to manipulate the contract.

Tools Used

Slither

INFO:Detectors:
MysteryBox.openBox() (src/MysteryBox.sol#43-65) uses timestamp for comparisons
Dangerous comparisons:
- randomValue < 75 (src/MysteryBox.sol#50)
- randomValue < 95 (src/MysteryBox.sol#53)
- randomValue < 99 (src/MysteryBox.sol#56)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#block-timestamp

Recommendations

instead of block.timestamp use anyother library for random number or block.number+someValue