Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Can cheat to win every time

0xziin

Summary

An attacker can cheat to only send a transaction when it's a win.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/main/src/EggHuntGame.sol#L70-L73

// Pseudo-random number generation (for demonstration purposes only)
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;

This code is public, then... an attacker can just process this code in local until he finds a win :
random < eggFindThreshold.
And then, just only send this winning transaction. That way, he only submit winning transactions to the network and then avoid losing gas
at each losing submission.

Impact

Only have winning transactions, never lose. Always mint Eggs.

Tools Used

Github, Manual review.

Recommendations

Either don't use the blockchain for a game about guessing a random value or use Chainlink VRF to generate a random number :
https://chain.link/vrf

Updates

Lead Judging Commences

m3dython Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.