Submission Details
Severity:
Deterministic prng
Summary
The EggHuntGame.searchForEgg() includes a deterministic (demonstration) source of random
Vulnerability Details
The following snippet in searchForEgg() generates a deterministic random number:
// Pseudo-random number generation (for demonstration purposes only)
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
All values can be determined, and msg.sender can be controlled. A contract can figure out which senders will succeed and use them to gain eggs.
Impact
The value of the random number can be determined, which could allow someone to have an unfair advantage in finding eggs.
Tools Used
Manual review
Recommendations
Replace with a proper source of random numbers
Updates
Lead Judging Commences
m3dython 3 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.