Description: Combining msg.sender, block.timestamp, block.prevrandao, and the contract storage value EggHuntGame::eggCounter
for hashing results in a predictable number. Since predictability undermines randomness,
malicious users can anticipate the outcome of the egg hunt and participate only when success is guaranteed.
Impact: This affects the fairness of the game, malicious users can ensure winning eggs
Proof of Concept:
There are a few attack vectors here.
Validators can know ahead of time the block.timestamp
, for block.prevrando
Although better than block.timestamp, it’s still pseudo-random and can be manipulated within some limits. It’s not safe for high-stakes applications like games, lotteries, or financial products.
Recommended Mitigation:
Recommended Mitigation: Consider using an oracle for your randomness like Chainlink VRF.
Insecure methods to generate pseudo-random numbers
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.