NFTs can have empty hashes, hence the NFT's image is the same

[c4-submissions]

Lines of code

https://github.com/arrng/arrng-contracts/blob/117d2eadc55eaabb5bea58396dbc8f421d735fd5/contracts/controller/ArrngController.sol#L582-L591

Vulnerability details

Impact

The Arrng protocol cannot guarantee the success or failure of your request. The logic for handling failed requests can be found here. As there are no Arrng documentation available, it's unclear how this scenario will unfold. Since Arrng's random requests may fail, the RandomizerRNG::fulfillRandomWords() function will never be executed by the Arrng protocol, resulting in the tokenId of the failed request lacking a hash. Since the hash influences the visual representation of the artwork, identical hashes would produce identical images. Naturally, we want to avoid having two NFTs with the same image.

Tools Used

Manual Review

Recommended Mitigation Steps

Arrng protocol is not reliable, so don't use it

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as duplicate of #1464

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid