Using Sapphire.randomBytes() is not source of randomness

[hats-bug-reporter[bot]]

Github username: @SB-Security Twitter username: SBSecurity_ Submission hash (on-chain): 0x9714ecf8b24eea7d69e15e15b3c29a9b8404d5da693ffb886de7f09dc47dd6a6 Severity: medium

Description: Description\ Untrusted source of randomness VaultBitcoinWallet::_random

Attack Scenario\ Using random bytes as an entropy source is problematic since it can be easily guessed from users.

Attachments

1. Proof of Concept (PoC) File

function generateOrder(
        address to,
    bytes memory _data,
    bytes32 _entropy
) public view returns (bytes memory orderData, bytes memory btcAddr) {
    uint256 _keyIndex = _ringKeys.length - 1;
    uint256 _offchainPubKeyIndex = offchainSignerPubKeys.length - 1;

    bytes32 userSeed = _random(_entropy);
    bytes memory recoveryData = abi.encode(_offchainPubKeyIndex, userSeed, to, _data);

    bytes20 _scriptHash = _keyDataToScriptHash(_offchainPubKeyIndex, _keyIndex, keccak256(recoveryData));

    (bytes memory _encryptedOrder,) = _encryptPayload(recoveryData);

    orderData = abi.encode(_keyIndex, _encryptedOrder);
    btcAddr = _generateAddress(_scriptHash, _isTestnet() ? TYPE_ADDR_P2SH_TESTNET : TYPE_ADDR_P2SH);
}

function _random(bytes32 _entropy) internal virtual view returns (bytes32) {
    return bytes32(Sapphire.randomBytes(32, abi.encodePacked(_entropy)));
}

2. Revised Code File (Optional)

Use VRF for Randomness

[party-for-illuminati]

https://github.com/hats-finance/illuminex-0x0bb4aa1f58719707405c231fcdf0b405714799cf/issues/15#issuecomment-2210787738