Eggstravaganza

Summary

The EggHuntGame.sol contract uses block.timestamp for game timing, which can be slightly manipulated by miners.

Vulnerability Details

The contract uses block.timestamp to define the start and end of game sessions:

While this is a common practice, miners can influence the timestamp by a few seconds, especially in time-sensitive operations like triggering game events or determining a winner.

Impact

• Malicious miners may influence game start/end boundaries to gain a time-based advantage.

• Time manipulation could be used to exploit the system if prizes are tied closely to specific timestamps.

Tools Used

• Manual code review

• Known blockchain miner capabilities analysis

Recommendations

• Where possible, use block.number with estimated block durations for timing.

• If using block.timestamp, include buffers or grace periods to reduce sensitivity.

• Never rely on timestamps for anything tied to randomness or exact scheduling.