Closed c4-submissions closed 11 months ago
141345 marked the issue as duplicate of #508
alex-ppg changed the severity to QA (Quality Assurance)
alex-ppg marked the issue as grade-c
hi @alex-ppg ,
This issue points to the same vulnerability as #1008. It has full description and POC. However, it was marked as unsatisfactory but the #1008 is marked as grade-b.
Can you please review the grading?
Hey @thangtranth, thanks for flagging this! This submission was marked as C
in grade, not an unsatisfactory
duplicate of #1008. In general, a QA downgraded issue will be awarded a single B
grade in its duplicate set and solely if the submission is of merit. As such, the B
grade has already been awarded to #1008 between its numerous duplicates.
Lines of code
https://github.com/code-423n4/2023-10-nextgen/blob/58090c9fbc036c06bbaa9600ec326034f2181a17/hardhat/smart-contracts/XRandoms.sol#L40-L43 https://github.com/code-423n4/2023-10-nextgen/blob/58090c9fbc036c06bbaa9600ec326034f2181a17/hardhat/smart-contracts/XRandoms.sol#L15-L33
Vulnerability details
Impact
The
randomWord
function in theXRandoms
contract exhibits a bias in generating random words. Specifically, it never returns "Watermelon" and doubles the probability of generating "Acai," undermining the function's randomness and fairness.Proof of Concept
The
randomWord
function generates a number (randomNum
) between 0 and 99, which is then used by thegetWord
function to return a corresponding word. However, due to a logic error ingetWord
, the range of returned words is only from index 0 to 98:https://github.com/code-423n4/2023-10-nextgen/blob/58090c9fbc036c06bbaa9600ec326034f2181a17/hardhat/smart-contracts/XRandoms.sol#L40-L43
The
getWord
function incorrectly handles this range, causing it to return "Acai" for both 0 and 1, and never return "Watermelon" (which should correspond to 99):https://github.com/code-423n4/2023-10-nextgen/blob/58090c9fbc036c06bbaa9600ec326034f2181a17/hardhat/smart-contracts/XRandoms.sol#L15-L33
The function becomes not random since Watermelon has probability of 0, Acai has probability of 2, and other words have probability of 1.
Tools Used
Manual
Recommended Mitigation Steps
To resolve this bias, the
getWord
function should be modified to directly return the word corresponding to the generated randomNum, ensuring each word has an equal probability of being selected:Assessed type
Error