EggHuntGame::searchForEgg has a predictable randomness generator
Summary
The randomness generator that searchForEgg provides is not random at all, all the compotents are visible on chain(block.timestamp,block.prevranda and eggCounter) and the keccak256 is not a safe way to generate randomness
Vulnerability Details
An attacker can easily predict when he is going to be the winner by simply using keccak256 outside of the contract until he gets result < eggFindThreshold.
Impact
Contract promises randomness and it doesn't provide true randomenss, this goes against the contract's main funcionality
Tools Used
Manual review
Recommendations
Use chainlink vrf randomness generator
Lead Judging Commences
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.