Submission Details
Severity:
Pseudo-Randomness Manipulation in EggHuntGame
Summary
The searchForEgg function in EggHuntGame contract uses predictable on-chain data for randomness, making it vulnerable to miner manipulation.
Vulnerability Details
The problematic randomness generation:
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
Miners can influence both block.timestamp and block.prevrandao, and users can front-run transactions when they see favorable outcomes.
Impact
High - Game fairness is compromised as both miners and players can manipulate outcomes.
Tools Used
Manual Review
Recommendations
Use Chainlink VRF for verifiable randomness
Updates
Lead Judging Commences
m3dython 10 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.