Root + Impact

Description

CustomerEngine.trigger_demand chooses demand size using only block.timestamp and msg.sender. Both are attacker controlled: callers can schedule submissions to favorable timestamps or spam transactions in a single block; miners can skew timestamps within consensus limits.

Risk

Likelihood: Any motivated caller or searcher can manipulate timestamps or addresses; the exploit requires no privileges.

Impact:

• Users bias the pseudo-random draw toward higher-requested quantities, skewing revenues and reputation adjustments.

• MEV actors can place their transactions in favorable positions, undermining fairness.

• Griefers can force repetitive minimum-size orders to reduce operational efficiency.

Proof of Concept

1. Submit multiple transactions in the same block with different addresses, each trying to push for requested == MAX_REQUEST.

2. Retain only the transaction that yields the desired value, letting the rest revert or drop.

3. Alternatively, mine (or collaborate with a miner) to nudge block.timestamp forward or backward, altering seed.

Illustrative Python snippet:

Recommended Mitigation

1. Replace the ad hoc seed with an oracle-backed randomness source (e.g., Chainlink VRF) or commit–reveal mechanism.

2. At minimum, include on-chain entropy that attackers cannot fully control, such as future block hashes or aggregated historical values.

3. Document the predictability so integrators can price the bias appropriately if stronger randomness is out of scope.