Mystery Box

Summary

The MysteryBox.sol::openBox function uses a random number to determine the level of mystery box the user will receive. This function generate the random number by using block.timestamp. Using this to generate the number is considered a bad source of randomness.

Vulnerability Details

Using block.timestamp as a source of randomness is not recommended, as the outcome can be manipulated by those calling the function. This can lead to users only calling the function when they can guarantee themselves a high rarity mystery box.

Impact

The contract can be exploited and the openBox function can be called only when the user will know they will receive a high rarity mystery box.

Tools Used

--Foundry

Recommendations

It is recommneded to use a decentralized oracle to produce random numbers, such as Chainlink VRF.