Since the randomness is only pseudo-random, it is not secure and can be exploited through front-running
Description: In the EggHuntGame::searchForEgg() function, a pseudo-random number is generated using block.timestamp, block.prevrandao, msg.sender, and eggCounter. However, validators can access all of these values when they create a block. This means a validator can predict the outcome before the transaction is finalized. As a result, a validator could call searchForEgg() only when they know it will mint a new NFT.
Impact: A large number of NFTs will be minted, exceeding the original 20% allocation. This will reduce the overall value of the NFTs.
Recommended Mitigation: Consider generating random numbers off-chain, either using services like Chainlink VRF or using your own internal server.
Lead Judging Commences
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.