Eggstravaganza

Summary

The EggHuntGame contract is vulnerable to front-running due to its reliance on predictable pseudo-randomness in the searchForEgg() function. An attacker can observe a successful transaction in the mempool and submit a similar transaction with guaranteed success in the same block. This undermines the fairness and integrity of the game.

Vulnerability Details

The core of the issue lies in how randomness is generated to determine whether a player successfully finds an egg:

All inputs used in the keccak256 hash are either publicly available or easily guessable at the time of transaction submission:

• block.timestamp: predictable within the same block

• block.prevrandao: constant for a block

• msg.sender: attacker can control this

• eggCounter: public state variable

This allows a malicious actor to mimic the exact conditions of a pending successful transaction and submit their own transaction in the same block to also find an egg — effectively front-running the original player.

PoC

Add this code to EggHuntGameTest.t.sol

Output:

Impact

Enables bots and malicious actors to guarantee egg mints by replicating pending successful transactions

• Compromises the randomness and fairness of the game

• Can lead to artificial inflation of egg count and undermine trust in the system

• Creates an uneven playing field that favors technically advanced users or attackers

Tools Used

Foundry

Recommendations

• Use secure randomness sources, such as:

  • Chainlink VRF

  • RNG from an oracle

• Alternatively, implement a commit-reveal scheme where users commit a guess and reveal it later to prevent prediction.

• Avoid using block.timestamp, block.prevrandao, or any other miner-controlled or publicly predictable values for randomness in game logic.

• Consider adding a delay or batching mechanism to limit back-to-back identical function calls.