Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Use of pseudo-random number in `EggHuntGame::searchForEgg()` allows anyone to mint an egg easily by pre-determining the "random" number

unitedcoolness26

Summary

In the function EggHuntGame::searchForEgg(), very deterministic variables are used to generate a "random" number, because of which the number can be guessed and an egg can be minted easily.

Vulnerability Details

A pseudo-random number is generated in the function EggHuntGame::searchForEgg() to decide if the caller can mint an egg NFT. But to prepare this number, these variables are being used:

  • block.timestamp

  • block.prevrandao

  • msg.sender

  • eggCounter

// EggHuntGame::searchForEgg() [lines 71...73]
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;

As these all four variables are very deterministic, this system can be exploited by someone in this way:

  1. Create a blockchain monitoring script. Get the pending block and calculate the random number using the same formula as used in the EggHuntGame contract (web3.js::keccak256() can be used to calculate keccak256 hash).

  2. When a favorable number is found, send the blockchain transaction for EggHuntGame::searchForEgg().

Impact

Allows someone to bypass the "random luck" logic of the game and mint an egg NFT.

Tools Used

Manual review

Recommendations

Use a trusted oracle for generating a random number, e.g. Chainlink's VRF.

Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!