Mystery Box

Summary

The randomness generation in the openBox function is predictable due to the use of block.timestamp and msg.sender, which can be manipulated or predicted by miners or users.

Vulnerability Details

The contract uses keccak256(abi.encodePacked(block.timestamp, msg.sender)) to generate a random value for determining rewards. Since block.timestamp can be manipulated by miners and msg.sender is public, this method of randomness is predictable and susceptible to exploitation.

Impact

Malicious users or miners could predict the outcome of the randomness and only interact with the contract when they are likely to receive high-value rewards. This could lead to unfair advantages and drain the contract of valuable assets.

Tools Used

Manual Code Review

Recommendations

Consider using a more secure source of randomness, such as Chainlink VRF or another oracle-based solution, to ensure that the randomness used for determining rewards cannot be easily predicted or manipulated.