Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable randomness in egg finding mechanism allows manipulation of game outcomes

teoslaf

Summary

The EggHuntGame::searchForEgg function uses predictable on-chain data for randomness generation, allowing miners and users to manipulate or predict egg-finding outcomes.

Vulnerability Details

The contract generates randomness using block variables and user-controlled data:

## EggHuntGame.sol
​
function searchForEgg() external {
require(gameActive, "Game not active");
require(block.timestamp >= startTime, "Game not started yet");
require(block.timestamp <= endTime, "Game ended");
​
@> uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
eggNFT.mintEgg(msg.sender, eggCounter);
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}
}

This randomness implementation has several critical flaws:

  1. block.timestamp and block.prevrandao can be influenced by miners

  2. msg.sender is controlled by the user

  3. eggCounter is predictable as it's a public state variable

  4. The comment "for demonstration purposes only" acknowledges the weakness

Impact

  • Miners can manipulate block variables to increase their chances of finding eggs

  • Users can predict outcomes and only execute transactions when they know they'll find an egg

  • Players with technical knowledge have an unfair advantage

  • The core game mechanic is compromised, undermining the entire gameplay experience

  • If eggs have economic value, this becomes a financial vulnerability

Tools Used

  • Manual code review

Recommendations

Use Chainlink VRF

Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insecure Randomness

Insecure methods to generate pseudo-random numbers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!