Submission Details
Severity:
Insecure Randomness Source
Summary
The MysteryBox::openBox() function uses block.timestamp and msg.sender to generate randomness for the rewards. These values are predictable and can be manipulated by an attacker to gain favorable rewards.
Vulnerability Details
Affected Code
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;
Impact
The attacker can manipulate the reward generation process to receive more valuable rewards by controlling the transaction’s timestamp and address.
Tools Used
Visual Studio Code
Solidity
Foundry
Recommended Mitigation
Use a more secure source of randomness, such as Chainlink VRF or a method that introduces more entropy.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.