Eggstravaganza

[H-01] Weak Randomness in the EggHuntGame::searchForEgg Function

Summary

The EggHuntGame::searchForEgg function in the EggHuntGame contract uses a pseudo-random number generator based on keccak256 and various block parameters, including block.timestamp and block.prevrandao, to determine if a player finds an egg. This method of randomness is weak and can be manipulated by miners or participants, which introduces a potential vulnerability in the game.

Vulnerability Details

The vulnerability occurs in the following function:

In this function, the randomness is generated using keccak256 on block.timestamp, block.prevrandao, msg.sender, and eggCounter. However, both block.timestamp and block.prevrandao can be influenced by miners, making the randomness predictable and potentially exploitable.

Impact

Miners or participants can potentially predict or control the random number generation by manipulating block parameters like block.timestamp or block.prevrandao, which could lead to unfair gameplay.

Tools Used

Manual code review

Recommendations

It is recommended to replace the current pseudo-random number generation with a more secure method, such as Chainlink VRF (Verifiable Random Function). Chainlink VRF offers a secure, tamper-proof source of randomness, ensuring that the random values used in the game cannot be manipulated.