Submission Details
Severity:
Weak Randomness in EggHuntGame::searchForEgg allows Participants to influance or predict the winer
**Description:** The use of `keccak256`hash functions on predictable values like `block.timestamp`,`block.prevrandao`, or similar data, including modulo operations on these values, should be avoided for generating randomness, as they are easily predictable and manipulable.
Malicious users can manipulate these values or know them ahead of time to found the egg.
<details><summary>code</summary>
``` javascript
function searchForEgg() external {
require(gameActive, "Game not active");
require(block.timestamp >= startTime, "Game not started yet");
require(block.timestamp <= endTime, "Game ended");
// Pseudo-random number generation (for demonstration purposes only)
>@ // @audit A fair random number generator
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))) % 100;
if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
eggNFT.mintEgg(msg.sender, eggCounter);
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}
}
```
</details>
**Impact:** Any participant can influance and found the egg & get the egg NFT!
<details><summary>code</summary>
``` javascript
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))) % 100;
```
</details>
**Proof of Concept:**
Participant can mine/manipulate their `msg.sender` value to result in their address being used to generated the winner!
**Tools Used:**
Aderyn & Manual
**Recommended Mitigation:** Use a secure and decentralized source of randomness, such as Chainlink VRF.Integrating Chainlink VRF would ensure that battle outcomes are genuinely random, enhancing fairness and trust in the game.
Updates
Lead Judging Commences
m3dython 5 months ago
Submission Judgement Published Assigned finding tags:
Insecure Randomness
Insecure methods to generate pseudo-random numbers
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.