Summary

Due to publically available data, attackers can predict the random index number.

Vulnerability Details

The func. drawCard uses a method to generate random index, which can be exploited due to following reasons:

• block.timestamp is publically available.

• msg.sender might be known incase if the attacker is the sender.

• block.prevrandao aka previous block hash is accessible also the miners can influence the value.

Impact

• Attackers can predict the random index which increases their winning chance.

• Malicious actor such as: miner, can observe the transaction in the mempool, calculate the random number, and attempt to frontrunning attack by submitting their own timing.

Tools Used

Manual Review

Recommendations

Use Chainlink's Verifiable Random Function (VRF), which provides cryptographically secure random index.