Predictable implementation of randomness can result in guaranteed 1 ETH rewards for users
Summary
The randomness implementation in the contract is predicatable and can be manipulated in favour of rewards for users.
Vulnerability Details
The randomValue variable is predictable.
Users can observe the block.timestamp and their own address (msg.sender), and since the hashing function keccak256 is deterministic, they can predict the result of the random number before calling openBox().
Impact
Users are able to manipulate the rewards in their favour, resulting in a guaranteed 1 ether for every 0.1 ether purchase of a mystery box.
Tools Used
Manual review
Recommendations
Consider using a more secure source of randomness, such as Chainlink VRF (Verifiable Random Function), to avoid predictability
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.