Eggstravaganza

Description:
The searchForEgg() function uses a pseudo-random number generation that can be manipulated by miners/attackers:

This uses block.timestamp and block.prevrandao which are both values that can be influenced by miners. Combined with msg.sender and eggCounter which are predictable, this makes the randomness weak and exploitable.

Impact:
Attackers can predict or manipulate the outcome of egg finding attempts, allowing them to game the system and find eggs more frequently than intended. This breaks the fairness of the game and could allow attackers to accumulate all available eggs.

Proof of Concept:

1. A miner notices an egg search transaction in the mempool

2. They manipulate block.timestamp and block.prevrandao to ensure the random number is below threshold

3. The miner includes the transaction in a block with their manipulated values

4. The miner's address always finds eggs, accumulating all NFTs unfairly

Recommended Mitigation:
Use a more robust randomness solution such as:

1. Chainlink VRF for verifiable randomness

2. Commit-reveal scheme

3. Oracle-based randomness

4. At minimum, use more unpredictable inputs like blockhash of previous blocks

Likelihood and Impact

• Impact: High

• Likelihood: High

• Severity: HIGH/Crit