Root + Impact

Description

The pizza_drop::airdrop module is intended to assign each registered user a random amount of APT (between 100–500 APT) when they register for the airdrop.

However, the randomness source used is timestamp::now_microseconds(), which is fully observable and manipulable by validators or users submitting transactions. This allows attackers to predict or slightly influence the assigned amount.

Specific Issue

• Using timestamps as randomness is insecure because the value is predictable and can be influenced by transaction ordering or submission time.

• Malicious users could time registration transactions to get the maximum payout (500 APT), or otherwise bias the distribution.

Risk

Likelihood: High

• Every registration call uses timestamp::now_microseconds().

• Validators and users can observe or manipulate timestamps to gain advantage.

Impact: High

• Users may consistently receive higher payouts than intended.

• The airdrop distribution becomes unfair, defeating the intended randomness and fairness guarantees.

Proof of Concept

A malicious validator can bias the result easily by selecting which block to put the transaction depending of the timestamp which give the best reward

Recommended Mitigation

Use a verifiable or deterministic randomness source instead of timestamps:
Use the Aptos randmness API: https://aptos.dev/build/smart-contracts/randomness

aptos_framework::randomness::u64_range(100, 500);