Eggstravaganza

Summary

• The searchForEgg() function in EggHuntGame uses a predictable pseudo-random number generation method, which can be manipulated by miners or users.

Vulnerability Details

• The random number is generated using:

  uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))) % 100;

• block.timestamp and block.prevrandao are public and can be influenced by miners.

• An attacker can front-run transactions or replay attempts to exploit predictable outcomes.

Impact

• Players (or miners) can predict or manipulate the outcome of searchForEgg() to guarantee egg findings, breaking game fairness.

Tools Used

• Manual review, knowledge of blockchain randomness pitfalls.

Recommendations

• Use a commit-reveal scheme with a trusted oracle (e.g., Chainlink VRF) for true randomness.

• If on-chain randomness is necessary, combine multiple inputs (like blockhash(block.number - 1)) and delay resolution.