Eggstravaganza

Summary

The searchForEgg() function is vulnerable to front-running due to its reliance on publicly visible inputs.

Vulnerability Details

• The pseudo-random number depends on block.timestamp, block.prevrandao, and msg.sender, which can be observed in the mempool.

• Miners or bots can replicate favorable conditions to guarantee egg findings.

Impact

• Players can be outcompeted by bots, undermining fairness.

Tools Used

Manual reviews

Recommendations

• Implement commit-reveal schemes or use Chainlink VRF.

• Add a small ETH fee per attempt to discourage spam.