Submission Details
Severity:
Use of `abi.encodePacked` with dynamic types inside `keccak256`
Summary
abi.encodePacked should not be used with dynamic types when passing the result to a hash function such as keccak256. Use abi.encode instead, which will pad items to 32 bytes, to prevent any hash collisions.
Vulnerability Details
uint256 standThreshold = (uint256(
// @ audit use abi.encode instead of abi.encodePacked.
keccak256(
abi.encodePacked(block.timestamp, msg.sender, block.prevrandao)
)
) % 5) + 17;
Impact
Tools Used
manual review
Recommendations
use abi.encode instead
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.