Submission Details
Severity:
Using weak source of randomness
Summary
Relying on block.timestamp and msg.sender to generate a random number in not good because the number is not completely random and can be predicted
Vulnerability Details
In openBox function it calculate the randomValue as result of hashing block.timestamp and msg.sender % 100 which a weak source of randomness .
Impact
User can get always the highest reward when he open a box
Tools Used
Manual review
Recommendations
Use Source of randomness as Chainlink VRF
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.