Submission Details
Severity:
Insecure Random Number Generation
Summary
On line 47 within openBox() a random number is being generated using the following:
uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender)))
which is an insecure method of generating randomness.
Vulnerability Details
This method of generating randomness is dependent on block.timestamp which can be manipulated by miners. This will essentially allow them to influnece the value of the random number generated.
Impact
The impact of this is that miners will be able to consistently target and win a high reward and in essence cheat the system.
Tools Used
Manual Review
Recommendations
Use a trusted source such as Chainlink VRF which allows for provable randomness.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.