Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

All the parameters chosen are bad sources of randomness and are deterministic #1564

Closed
c4-submissions opened this issue Nov 13, 2023 · 4 comments
Closed

All the parameters chosen are bad sources of randomness and are deterministic #1564

c4-submissions opened this issue Nov 13, 2023 · 4 comments
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working duplicate-1901 unsatisfactory does not satisfy C4 submission criteria; not eligible for awards

Comments

@c4-submissions
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/hardhat/smart-contracts/RandomizerNXT.sol#L55-L59

Vulnerability details

Impact

All the parameters chosen to generate a random token hash in calculateTokenHash() are predictable and a bad source for randomness.

Proof of Concept

_mintIndex, blockhash, randomNumber(), randomWord() can all be predicted by a miner in advance and hence is not truly random.

Tools Used

Manual inspection.

Recommended Mitigation Steps

Depend on VRF randomizer instead of RandomizerNXT.sol.

Assessed type

Other
@c4-submissions c4-submissions added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Nov 13, 2023
c4-submissions added a commit that referenced this issue Nov 13, 2023
@c4-submissions
t0x1c issue #1564
97d998b
@c4-pre-sort
Copy link

141345 marked the issue as duplicate of #163

@c4-judge
Copy link

c4-judge commented Dec 4, 2023

alex-ppg marked the issue as duplicate of #1901

@c4-judge c4-judge added duplicate-1901 unsatisfactory does not satisfy C4 submission criteria; not eligible for awards and removed duplicate-163 labels Dec 4, 2023
@c4-judge
Copy link

c4-judge commented Dec 5, 2023

alex-ppg marked the issue as unsatisfactory:
Invalid

1 similar comment
@c4-judge
Copy link

c4-judge commented Dec 5, 2023

alex-ppg marked the issue as unsatisfactory:
Invalid

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working duplicate-1901 unsatisfactory does not satisfy C4 submission criteria; not eligible for awards
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@c4-judge @c4-pre-sort @c4-submissions