Mystery Box

Summary

randomValuecan be predicted because block.timestamp is not a random factor and can be manipulated by the miner.

Vulnerability Details

By sending transactions at a certain time, we can predict the value of randomValue, thus getting more expensive boxes.

Vulnerable code:

For example, msg.sender = 0x358AA13c52544ECCEF6B0ADD0f801012ADAD5eE3, when block.timestamp = 1727438983, randomValue will always be 99.

The miner can control the block.timestamp value within 5 seconds and is guaranteed to keep randomValue high.
So by sending a transaction at a certain time and manipulating block.timestamp, a miner can keep randomValue high. This allows an attacker to continually receive expensive boxes.

Impact

By controlling randomValue, an attacker can obtain expensive boxes thereby draining the contract funds.

Tools Used

Manual code review.

Recommendations

Use Chainlink VRF to generate random numbers, can also use third party services or oracles to get random numbers.