Submission Details
Severity:
Weak randomness in `MysteryBox::openBox` function.
Summary
Hashing block.timestamp and msg.sender together results in a predictable number. This number is not a good choice for a random number as malicious actors can manipulate it and determine it well ahead of time to choose the rarest reward possible.
Vulnerability Details
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;
Impact
Any user could influence the reward they could win, thus trying to win the rarest reward possible.
Tools Used
VS Code
Recommendations
Consider using cryptographically provable random number generator such as Chainlink VRF.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.