`randomValue` in `MysteryBox::openBox` is not random
Relevant GitHub Links
https://github.com/Cyfrin/2024-09-mystery-box/blob/main/src/MysteryBox.sol#L47
Summary
The MysteryBox::openBox function uses block.timestamp and msg.sender to calculate a random value. These values can be manipulated by an attacker to increase their rewards.
Impact
An attacker can manipulate the inputs used for random value calculation, allowing them to receive higher rewards.
Recommendations
Integrate Chainlink VRF for secure random value generation. Implement two functions: one to request the random value (by calling requestRandomWords on the VRF Coordinator contract), and another to store the random value, triggered by the oracle (fulfillRandomWords).
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.