Eggstravaganza

Description: Hashing msg.sender, block.timestamp, block.prevrandao and eggCounter together creates a predictable final number. A predictable number is not a good random number. Malicious users can manipulate these values or know them ahead of time to find an egg for themselves.

Impact: Any user can find an egg and mint it to themselves.

Proof of Concept:

There are a few attack vectors here.

1. Validators can know ahead of time the block.timestamp, block.prevrandao and eggCounter and use that knowledge to predict when / how to participate.

2. Users can manipulate the msg.sender value to result in a random number below the eggFindThreshold.

Using on-chain values as a randomness seed is a well-known attack vector in the blockchain space.

Recommended Mitigation: Consider using an oracle for your randomness like Chainlink VRF. It also supports mocks which you can use for demonstration purposes.