Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable Randomness in searchForEgg

0xnas

Summary

The function searchForEgg() generates randomness using:

uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
​

Since block.timestamp and block.prevrandao can be manipulated by miners, attackers may influence egg discovery results.

Vulnerability Details

  • Miners can reorder transactions or adjust block.timestamp to improve their chances of finding eggs.

  • This could lead to unfair gameplay, where specific players consistently get better results.

Impact

  • Attackers can farm eggs at a higher rate than intended.

  • The game could become unfair and centralized around miners.

Tools Used

  • Manual code review.

  • Static analysis tools like Slither.

Recommendations

  • Use Chainlink VRF for truly unpredictable randomness:

    import "@chainlink/contracts/src/v0.8/VRFConsumerBase.sol";

  • Alternatively, use user-provided entropy, such as off-chain data.

Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.