Eggstravaganza

Summary

In EggHuntGame::searchForEgg, eggs should be found at random based on EggHuntGame::eggFindThreshold (default of 20% chance). However, this randomness can be predicted in advance before calling EggHuntGame::searchForEgg, severely disrupting the fairness of the EggHuntGame.

Vulnerability Details

In EggHuntGame::searchForEgg#L71-L73, the winner is selected using a random number. However, hashing block.timestamp, block.prevrandao, msg.sender and eggCounter (a publicly viewable variable) creates a predictable final number. A predictable number is not a good random number, making the entire random egg hunt game worthless.

1. Validators can know ahead of time the block.timestamp and block.prevrandao and use that to predict when to participate. See the solidity blog on prevrandao.

2. Players can mine/manipulate their msg.sender value to result in their address being used to win the egg.

Using on-chain values as a randomness seed is a well-documented attack vector in the blockchain space.

Impact

Impact: High, non-random winner severely disrupts the fairness of the EggHuntGame.
Likelihood: High, players are incentivized to exploit this vulnerability to win the egg
Severity: High

Tools Used

Manual review

Recommendations

Consider using a cryptographically provable random number generator such as Chainlink VRF, or use a commit-reveal scheme.