Weak randomness in `EggHuntGame::searchForEgg` allows for users to influence or predict the number to find an egg
Description: Hashing msg.sender, block.timestamp, block.prevrandao and EggHuntGame::eggCounter creates a predictable number. A predictable number is not a good random number. It can be exploited by users by manipulating the numbers or knowing ahead of time to choose when to search for an egg.
Impact: Any users can influence or predict the winning number to find an egg and mint an NFT, making the chance of finding an egg useless.
Proof of Concept:
Validators can know ahead of time the
block.timestampand use it to predict when to search for an egg.Users can mine/manipulate their
msg.sendervalue.
Using on-chain values as a randomness seed is a well-documented attack vector in the blockchain space.
Recommended Mitigation: Consider using a cryptographically provable number generator such as Chainlink VRF.
Lead Judging Commences
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.