Aptos Pizza Drop
Cyfrin
Beginner FriendlyGameFi
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

The random reward is based only on the timestamp. That’s not secure randomness. Anyone can guess or brute-force the assigned reward by observing the block time.

inwoninwonurang

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

let time = timestamp::now_microseconds();
let random_val = time % 401;
let random_amount = 100 + random_val;
​

Recommended Mitigation

- let time = timestamp::now_microseconds();
-let random_val = time % 401;
-let random_amount = 100 + random_val;
​
+ use aptos_std::rand;
​
Updates

Appeal created

bube Lead Judge 11 days ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.