Canto Identity Subprotocols contest - leopoldjoy's results

Lines of code

https://github.com/code-423n4/2023-03-canto-identity/blob/main/canto-namespace-protocol/src/Tray.sol#L247

Vulnerability details

Impact

By manipulating the ordering of transactions in blocks, miners could manipulate the characterIndex values of a Tray's tiles. This could result in miners being able to specifically select characterIndex values that they want for specific Tray tiles, rather than truly random values.

Proof of Concept

Simply by altering the order of pending transactions into blocks, a miner who desires specific characterIndex values could manipulate them. When a user (or miner's address in this exploit) calls the buy() function of the Tray contract, it in turn repeatedly calls (for each tile) the _drawing function, providing uint256(lastHash) as input. The lastHash values is a variable stored in the state of the contract, and updated before each call. If these calls' order is changed, then the inputted lastHash values will vary. The _drawing() function in turn uses this inputted value towards the randomness generated by the call to Utils.iteratePRNG(_seed) here. The iteratePRNG is a simple on-chain PRNG function as you can see here. The characterIndex value is then set based on this randomness as you can see here, here and here.

Tools Used

Manual analysis.

Recommended Mitigation Steps

Use of the Chainlink VRF oracle would prevent this vulnerability.