CustomerEngine.trigger_demand derives a pseudo-random seed using the current block timestamp and the caller address. Example excerpt from the contract:

Description

• CustomerEngine.trigger_demand derives a pseudo-random seed using the current block timestamp and the caller address. Example excerpt from the contract:

• The seed is then used to compute a demand size and an extra-item chance. Because block.timestamp is a miner-influenced field, and msg.sender is known to the caller, this seed is predictable and manipulable.

Risk

Likelihood: Medium

• Common mistake, easy to exploit when financial incentives exist.

Impact: High

• Attackers or colluding miners can bias demand size to obtain more items, move funds, or otherwise game economics.

Recommended Mitigation

• Use a secure on-chain randomness oracle such as Chainlink VRF for any security-critical randomness.

• Or adopt a commit-reveal scheme: user commits a hash in one transaction and reveals in a later transaction; combine the revealed nonce with on-chain entropy (previous blockhash) to derive randomness