Mystery Box

Summary

With pos nature of eth2.0 , block proposers can have the ability the propose a series of blocks .
when that happens , they would know the timestamp of next block and they can pass their choice in openBox buy pre-calculating the result of

uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;

since it relies on timestamp, and msg.sender , the proposers can know the random value and hence can predict which reward will be given

Impact

unfair advantage to people having information about next block timestamp

Tools Used

Manual review

Recommendations

use better source of randomness like chainlink vrfs