Summary

Manipulable Random Number Generation

Vulnerability Details

The searchForEgg() function uses block.timestamp and block.prevrandao to generate a pseudo-random number. An attacker can manipulate the transaction execution time and calculate valid random results in advance through off-chain prediction, achieving a 100% success rate in minting NFTs.

Example code: uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))) % 100;

Impact

Allows malicious players to fully control the NFT minting process, undermining the fairness of the game's economic model, potentially leading to excessive issuance and devaluation of NFT assets.

Tools Used

Manual Review

Recommendations

Integrate a trusted random number oracle like ChainLink VRF, or use a commit-reveal scheme to ensure unpredictability.