Eggstravaganza

Summery : The searchForEgg function in the EggHuntGame contract is vulnerable to random number manipulation. An attacker can change the block.timestamp to control the random number, making it meet the condition random < eggFindThreshold. This allows the attacker to easily get a unique Egg NFT, giving them an unfair advantage in the game. This weakness in the random number generation system allows the game to be unfairly manipulated

Proof Of Code

Demonstrating the Random Number Manipulation Attack on EggHuntGame Contract This test case demonstrates how an attacker can manipulate the random number generation in the EggHuntGame contract to gain an unfair advantage. The attack takes advantage of the fact that the game uses block.timestamp to generate random numbers, which can be manipulated.

Attack Scenario:

1. Owner Starts the Game: The game is started by the owner with a certain Duration (in this case, 80).

2. Attacker Manipulates the Timestamp: The attacker (using a different address, user1) can then manipulate the block.timestamp using the vm.warp() function.

3. Search for Egg: The attacker then calls the searchForEgg() function. Due to the manipulated timestamp, the random number generated will meet the condition random < eggFindThreshold, allowing the attacker to get the unique Egg NFT.

Test Execution:

After running the test case, the attacker successfully receives a unique Egg NFT.

This proof of concept shows how easily an attacker can manipulate the game’s random number generation and gain an unfair advantage by simply manipulating the timestamp. It highlights a critical flaw in the contract’s design, which needs to be addressed to ensure fair gameplay

Tools Used

1) VS Code 2) Manual Review

Recommendations

Use Chainlink VRF for Secure Random Number Generation. To prevent manipulation and ensure fair gameplay, we recommend using Chainlink VRF (Verifiable Random Function) for generating random numbers in the EggHuntGame contract. Chainlink VRF provides a secure and tamper-proof way to generate random numbers, ensuring fairness for all players.

For more details on how to implement Chainlink VRF, you can find the official documentation here : [Link] (https://docs.chain.link/vrf)