Aptos Pizza Drop

Weak and Predictable Randomness can cause unfair allocation of airdrop to users.

Description

• The airdrop amount depends on timestamp::now_microseconds(), which is deterministic and predictable.

• Attackers can time their registration transactions to maximize their rewards.

• An attacker can calculate the exact timestamp and predict the amount they'll receive, potentially timing their registration to get maximum allocation (500).

Risk

Likelihood:

• Every time a user registers, their reward is derived from timestamp.

• Users can front-run or retry transactions until they receive high allocations.

Impact:

• Creates unfair distribution of airdrops.

• Wealthy/technical participants can bias results in their favor, undermining fairness of the drop.

Proof of Concept

So, instead of using a modulus function with timestamp, we should instead focus on using Oracles to generate a random number for allocation to be done fairly.
In the current scenario, any user can register by noting the timestamp condition and registering accordingly.

Let's say :
A user gets in at timestamp 801, then 801%401 will be 400 and +100 to that will make it 500.
Now, the next user will wait for the timestamp to go to 1202, so that 1202%401 will return 400 and +100 to that equals 500. So the users might misuse it to register at timestamps which are 1 less than multiples of 401 to gain maximum value with modulus function and hence greater allocation.

Recommended Mitigation

Using a randomised function to pick values between 100-500, it will ensure that allocation is done extremely randomly instead of a fixed timestamp based allocation which will increase fairness to all and also maintain randomisability.