Eggstravaganza

Summary

The contract uses insecure, predictable pseudo-random number generation to determine if a player finds an egg, making it susceptible to manipulation.

Vulnerability Details

• The random number is based on block.timestamp, block.prevrandao, and msg.sender, which are predictable by users and miners.

• This allows manipulation of input parameters to consistently win the egg.

Impact

Players (especially bots or miners) can predict or brute-force winning attempts, severely compromising fairness and integrity of the game.

Tools Used

Manual review

Recommendations

• For simple games, use Chainlink VRF (Verifiable Random Function) for secure randomness.

• If using pseudo-random logic for demonstration, clearly document its insecurity and restrict for testing only.