Eggstravaganza

Summary

The searchForEgg function uses a predictable pseudo-random number generation mechanism that can be exploited by attackers to determine the outcome of egg searches in advance, giving them an unfair advantage over other players.

Vulnerability Details

The current implementation uses block variables and user inputs to generate random numbers:

This is vulnerable because all inputs to the random number generation are available before the transaction is mined.

An attacker can:

1. Create a script to calculate the outcome of searchForEgg before submitting a transaction

2. Only submit transactions when they know they will find an egg

3. Front-run other players transactions when favorable outcomes are detected

4. Avoid wasting gas on unsuccessful attempts

Impact

MEDIUM severity because it gives attackers a significant advantage in the game and wastes gas for honest players who can't predict outcomes.

Tools Used

Manual code review

Recommendations

Implement a more secure random number generation mechanism, for example Chainlink VRF (Verifiable Random Function).