Submission Details
Severity:
Pseudo-Randomness Manipulation in EggHuntGame
Summary
The searchForEgg function in EggHuntGame contract uses predictable on-chain data for randomness, making it vulnerable to miner manipulation.
Vulnerability Details
The problematic randomness generation:
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
Miners can influence both block.timestamp and block.prevrandao, and users can front-run transactions when they see favorable outcomes.
Impact
High - Game fairness is compromised as both miners and players can manipulate outcomes.
Tools Used
Manual Review
Recommendations
Use Chainlink VRF for verifiable randomness
Updates
Lead Judging Commences
m3dython 5 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.