Submission Details
Severity:
Pseudo-Random Number Generation Vulnerability
Summary
Location: EggHuntGame.sol, searchForEgg() function
Vulnerability Details
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
Impact
Miners can manipulate block.timestamp and block.prevrandao
Users can predict outcomes by frontrunning transactions
Game fairness can be compromised
Tools Used
manual review
Recommendations
Use a commit-reveal scheme or oracle-based randomness
Consider using Chainlink VRF for verifiable randomness
Updates
Lead Judging Commences
m3dython 4 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.