Eggstravaganza

First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: high
Valid

Weak randomness in `EggHuntGame::searchForEgg`, block proposer may predict or manipulate the outcome

Description: Combining msg.sender, block.timestamp, block.prevrandao, and the contract storage value EggHuntGame::eggCounter
for hashing results in a predictable number. Since predictability undermines randomness,
malicious users can anticipate the outcome of the egg hunt and participate only when success is guaranteed.

Impact: This affects the fairness of the game, malicious users can ensure winning eggs

Proof of Concept:
There are a few attack vectors here.
Validators can know ahead of time the block.timestamp, for block.prevrando Although better than block.timestamp, it’s still pseudo-random and can be manipulated within some limits. It’s not safe for high-stakes applications like games, lotteries, or financial products.

Recommended Mitigation:
Recommended Mitigation: Consider using an oracle for your randomness like Chainlink VRF.

Updates

Lead Judging Commences

m3dython Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.