Submission Details
Severity:
Weak Randomness in searchForEgg() function
Summary
The Egg minting is based on a random number that should be lower than a certain threshold (default 20)
/// @notice Participants call this function to search for an egg.
/// A pseudo-random number is generated and, if below the threshold, an egg is found.
function searchForEgg() external {
...
// Pseudo-random number generation (for demonstration purposes only)
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
eggNFT.mintEgg(msg.sender, eggCounter);
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}
}
Vulnerability Details
All the used elements for generating a random number are known
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
I can create a list of future random numbers:
function testWeakRandomness() public {
uint256 random = 0;
uint256 eggCounter = 0;
uint256 eggFindThreshold = 20; // we can get it's actual value, as it's declared to public
for ( uint256 i = 0 ; i < 100 ; i++ ){
random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))) % 100;
if (random <= eggFindThreshold) {
eggCounter++;
}
vm.warp(block.timestamp + 1);
console2.log(random);
}
}
Impact
The Random Number is predictable and I can generate a list of future random numbers and know when the egg will be minted
Tools Used
Solidity, Foundry, Manual Code Review
Recommendations
Switch to an external Randomness Service (ex: Chainlink VRF - https://docs.chain.link/vrf)
Updates
Lead Judging Commences
m3dython 4 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.