Weaker randomness
Summary
Description: The SpookySwap contract uses the random logic to generate a random number. The random logic uses the block.timestamp and other block data as a seed for the random number. However, the block.timestamp and other block data can be manipulated by the miner. The miner can pick this parameters to the desired value and predict the random number.
Line of code: TrickOrTreat.sol#L57
Impact
The miner can predict the random number and manipulate the game.
Tools Used
Manual code analysis
Foundry for testing
Recommendations
Consider using the Chainlink VRF to generate a random number.
Appeal created
[invalid] Weak randomness
It's written in the README: "We're aware of the pseudorandom nature of the current implementation. This will be replaced with Chainlink VRF in later builds." This is a known issue.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.