Aptos Pizza Drop
Cyfrin
Beginner FriendlyGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

H-01: Weak Randomness Implementation Using Timestamp

agilegypsy

Root + Impact

Description

  • The PizzaDrop contract should generate unpredictable random slice selections to ensure fair distribution among participants

  • The contract uses timestamp::now_microseconds() for randomness generation, which is predictable and manipulable by validators

public entry fun get_random_slice(): u8 {
@> let now = timestamp::now_microseconds();
@> let random_value = now % 8;
random_value as u8
}

Risk

Likelihood:

  • Validators control block timestamps and can manipulate microsecond precision to influence outcomes

  • The modulo operation creates predictable patterns exploitable in every transaction

Impact:

  • Unfair slice distribution allowing malicious actors to consistently claim desired pizza slices

  • Loss of user trust in the randomness mechanism and platform integrity

Proof of Concept

// Attacker can predict outcomes by analyzing timestamp patterns
public fun exploit_weak_randomness(): u8 {
let predicted_time = timestamp::now_microseconds();
let target_slice = 7; // Attacker wants slice 7
​
// Calculate required timestamp to get slice 7
let needed_remainder = target_slice;
let current_remainder = predicted_time % 8;
​
// Validator can adjust timestamp within block time bounds
// to achieve desired remainder
needed_remainder
}

The vulnerability allows validators to manipulate block timestamps to achieve desired random outcomes. Since get_random_slice() uses timestamp::now_microseconds() % 8, an attacker controlling validation can influence the microsecond precision to target specific slice values. This completely breaks the fairness assumption of random distribution.

Recommended Mitigation

- public entry fun get_random_slice(): u8 {
- let now = timestamp::now_microseconds();
- let random_value = now % 8;
- random_value as u8
- }
​
+ #[randomness]
+ public entry fun get_random_slice(ctx: &mut TxContext): u8 {
+ let generator = new_generator(ctx);
+ let random_value = generate_u8_in_range(&mut generator, 0, 7);
+ random_value
+ }

The fix implements Aptos's secure randomness API using the #[randomness] annotation. This provides cryptographically secure randomness that cannot be manipulated by validators or any other party. The new_generator() creates a secure random number generator seeded with entropy from the Aptos randomness beacon, ensuring truly unpredictable outcomes for fair pizza slice distribution.

Updates

Appeal created

bube Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Predictable randomness

The `get_random_slice` function should only be called by the owner via the `register_pizza_lover` function. Also, the `owner` is trusted and will not choose a specific time for a new user to register. Therefore, I disagree with the claim of most reports in this group that an attacker can manipulate the random number of pizza slices. But I agree with the root cause of the reports in this group, that the random distribution is not completely random.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.