NFTX contest - maplesyrup's results

A community-owned protocol for NFT index funds

General Information

Platform: Code4rena

Start Date: 06/05/2021

Pot Size: $66,000 USDC

Total HM: 16

Participants: 11

Period: 6 days

Judge: cemozer

Total Solo HM: 9

Id: 8

League: ETH

NFTX

Findings Distribution

Researcher Performance

Rank: 9/11

Findings: 3

Award: $1,234.68

🌟 Selected for report: 2

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: 0xRajeev

Also found by: JMukesh, cmichel, gpersoon, maplesyrup, pauliax

Labels

bug
duplicate
2 (Med Risk)
Acknowledged

Awards

224.9987 USDC - $225.00

External Links

Handle

maplesyrup

Vulnerability details

Impact

Using blockhash/blocknumber and randNone are subject to attack, particularly by malicious miners:

https://medium.com/coinmonks/attack-on-pseudo-random-number-generator-prng-used-in-1000-guess-an-ethereum-lottery-game-7b76655f953d

This could be used to the behavior of getRandomTokenIdFromFund to cause a preferential TokenId to be returned. It allows for gaming of the system by miners or a savvy attacker.

Proof of Concept

Code is at - https://github.com/code-423n4/2021-05-nftx/blob/f6d793c136d110774de259d9f3b25d003c4f8098/nftx-protocol-v2/contracts/solidity/NFTXVaultUpgradeable.sol#L418

Tools Used

Slither

Use of an on-chain oracle for true randomness:

ChainLink- https://blog.chain.link/verifiable-random-functions-vrf-random-number-generation-rng-feature/ RanDAO - https://github.com/randao/randao Provable - https://provable.xyz/

#0 - cemozerr

2021-05-25T23:04:54Z

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter