Summary

Taking modulo of the hash of block.timestamp, msg.sender creates a predicted number.

Suppose the hash generation produces a very large number: 1234567890123456789012345678901234567890.
Converting this to uint256 gives us the same large number.Taking modulo 100 of this number gives us 90.
So, regardless of the actual size of the hash, our final randomValue would be 90 in this case.
1234567890123456789012345678901234567890 % 100 = 90 Because the last two digits are 90, which is less than 100.

Impact

Malicious user can predict the number and exploit openBoxfunction to get the highest reward every time.

Tools Used

Manual.

Recommendations

Randomness considerations: while this method provides a pseudo-random number, it's not cryptographically secure. For critical applications, consider using more robust random number generation methods.