Submission Details
Severity:
Weak Randomness in `random` value generated inside EggHuntGame::searchForEgg, allows anyone to find eggs very quickly
Summary
Hashing msg.sender, block.timestamp, block.prevrandao together creates a predictable final number. A predictable number is not a good random number.
Vulnerability Details
Validators can know ahead of time the block.timestamp and block.prevrandao and use that knowledge to predict when / how to participate. See the solidity blog on prevrando here.
Impact
Malicious users can manipulate these values or know them in advance to find the eggs.
Tools Used
Foundry
Aderyn
Slither
Recommendations
Consider using an oracle for your randomness like Chainlink VRF.
Updates
Lead Judging Commences
m3dython 5 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.