Eggstravaganza

Summary

Vulnerability Details

The searchForEgg function in the EggHuntGame Contract uses a pseudo-random number generation uses block.timestamp, block.prevrandao, msg.sender, and eggCounter. These are predictable or manipulable by miners or users (e.g., timing transactions to influence block.timestamp).

Impact

Players or miners could cheat to increase their egg-finding chances.

Tools Used

manual review

Recommendations

Use a secure randomness source like Chainlink VRF or accept the limitation and document it as a game design choice. For testing, this might be intentional, but it’s insecure for production.