Eggstravaganza

Summary

The searchForEgg function uses keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter)) % 100 for randomness, determining if an egg is found based on a threshold.

Vulnerability Details

This method is insufficient for high-stakes randomness, as miners or front-runners could influence results, compromising game fairness. For example, an attacker could delay transactions to align block.timestamp for better random numbers, increasing egg find chances.

Impact

block.timestamp and block.prevrandao are predictable, allowing attackers to time transactions for favorable outcomes, especially given block.prevrandao is beacon chain data post-merge Ethereum, still manipulable by transaction ordering.

Tools Used

• Manual code review

• Solidity best practices and ERC721 standard guidelines

• Grok by xAI

Recommendations

Implement a secure randomness source like Chainlink VRF. Modify searchForEgg to request randomness from an oracle, handling callbacks to determine outcomes.