Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Insecure Randomness + Lack of Access Control in searchForEgg function (EggHuntGame.sol)

simranjitsinghss

Summary:

Hi,

I have found out some potential bugs which can lead to multiple inconsistencies in the smart contract EggHuntGame.sol.

Vulnerability Details:

The key details of the potential vulnerabilities in the code can be given as follows:

  • Insecure Randomness:

    In function searchForEgg, it uses block.timestamp and block.prevrandao, which leads to predictable results and helps to increase their chances of finding an egg.

  • Lack of Access Control:

    eggCounter is not directly modifiable by users but it's value tied to NFT minting eggNFT.mintEgg. AsEggstravaganzaNFT doesn't validate tokenId uniqueness, attacker can exploit it to mint duplicate/invalid NFTs.

function searchForEgg() external {
require(gameActive, "Game not active");
require(block.timestamp >= startTime, "Game not started yet");
require(block.timestamp <= endTime, "Game ended");
​
// Pseudo-random number generation (for demonstration purposes only)
uint256 random = uint256(
// Insecure Randomness
@> keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))) % 100;
​
if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
// Lack of Access Control
@> eggNFT.mintEgg(msg.sender, eggCounter);
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}
}

Impact:

  • Insecure Randomness:

    Attacker could predict the random number to increase their chances of finding an egg.

  • Lack of Access Control:

    Attacker can mint unlimited NFTs and makes the DoS scenario for other users.

Tools Used:

Manual Review + VS Code

Recommendations:

  • Insecure Randomness:

    Use Chainlink VRF, ensure tamper-proof randomness.

  • Lack of Access Control:

    Enforce unique tokenId values and prevents unauthorized minting + make the function private.

References:

Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.