Mystery Box

Summary

In uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100; looks like this protocol use timestamp & msg.sender to keccak a hash, then make it a range between 0 to 99.

Vulnerability Details

remix example
refer

Impact

It actually not really random, miner can calculate the outcome, then decide to mine the block or not.
They will mine the block until the rarity reach the biggest reward, so that they can easily make profit.

Tools Used

slither

Recommendations

Do not use on-chain data as random number, use protocol such as chainLink.