Aptos Pizza Drop
Cyfrin
Beginner FriendlyGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Predictable Randomness

raminidalf

Root + Impact

Description

  • Random slice uses timestamp modulo, which is predictable.

let random_val = time % 401; // @> predictable randomness

Risk

Likelihood:

  • Attackers can predict timestamp.

Impact:

  • Slice amount can be precomputed.

  • Unfair distribution of APT.

Proof of Concept

// Compute time at which get_random_slice will give max value

Recommended Mitigation

- let random_val = time % 401;
+ let random_val = hash(time, user_addr) % 401; // use hash or external VRF
Updates

Appeal created

bube Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Predictable randomness

The `get_random_slice` function should only be called by the owner via the `register_pizza_lover` function. Also, the `owner` is trusted and will not choose a specific time for a new user to register. Therefore, I disagree with the claim of most reports in this group that an attacker can manipulate the random number of pizza slices. But I agree with the root cause of the reports in this group, that the random distribution is not completely random.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.