Trick or Treat

Summary:

Weak Randomness in SpookySwap::trickOrTreat allows users to influence or predict a trick or treat

Vulnerability Details

Hashing msg.sender, block.timestamp, block.prevrandao together creates a predictable random number. A predictable number is not good number. Malicious users can manipulate these values or know them ahead of the time to choose how to predict trick or treat themselves.

Proof of Concepts:

1. Validators can know ahead of the time the block.timestamp and block.prevrandao and use it to predict when / how to participate.

2. Users can mine / manipulate msg.sender value to result in their address being used to generate appropriate treat feature!

3. Project may die down soon, because of lack of liquidity.

Using on-chain values as randomness seed is a well-documented attack vector in blockchain space.

Impact

Any user can influence the trick or treat feature, minting nfts with twice less money. Making the entire raffle worthless if it becomes a gas war who wants to predict trick or treat. And project may die down soon, because of lack of liquidity.

Tools Used

Manual

Recommendations

Consider using a cryptographically provable random number generator such as ChainLink VRF.