`SpookySwap::trickOrTreat` weak-PRNG
Summary
In this function, user should "randomly" get a trick(double the price to pay NFT) or get a treat(with half price for NFT).
And in here using block.timestamp, msg.sender, nextTokenId and block.prevrandao to generate random number.
The on-chain random number generation is not really random.
Vulnerability Details
This kind of on-chain random number is not totally random.
Some miner/user might calculate the outcome number previously.
Then decide to do or not to do the trickOrTreat function to get a half-price treat.
refer
Impact
Likelihood is medium/low, and severity should be high, because malicious miner/user can easily get a half-price NFT.
Breaks the intention of this protocol.
Tools Used
slither
Recommendations
Should use off-chain oracle to generate random number, such as chainLink
Appeal created
[invalid] Weak randomness
It's written in the README: "We're aware of the pseudorandom nature of the current implementation. This will be replaced with Chainlink VRF in later builds." This is a known issue.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.