Eggstravaganza

Summary

The EggHuntGame contract uses a weak source of randomness for determining whether a player finds an egg. The current implementation relies on block.timestamp, block.prevrandao, msg.sender, and eggCounter, all of which are predictable or manipulable under certain conditions. This can lead to unfair advantages for attackers who can game the system.

Vulnerability Details

Affected code:

• searchForEgg()

The randomness is currently generated as follows:

From the function:

• block.timestamp → Miners/validators can slightly manipulate this value within a few seconds.

• block.prevrandao → This is not truly random and can be influenced by block producers.

• msg.sender → Fully controlled by the transaction sender.

• eggCounter → Predictable since it increases sequentially.

Because these values are predictable or manipulable, attackers can influence or precompute favorable values, increasing their chances of finding eggs unfairly.

Impact

• Players can simulate possible outcomes off-chain and only call searchForEgg() when they know they will win.

• Validators/miners can subtly adjust block.timestamp or leverage their ability to influence block.prevrandao to improve their success rate.

• Sophisticated users could deploy contracts that interact with searchForEgg() to optimize their probability of finding eggs.

Tools Used

• Manual review

Recommendations

I would recommend using an off-chain oracle like Chainlink and its VRF (Verifiable Random Function) that provides tamper-proof randomness that cannot be manipulated by miners or players.