mediumOracle manipulationEVM-Solidity
Boost Core Incentive Protocol: Both block.prevrandao and block.timestamp are not reliably source of randonness
- Payout
- $0
- Protocol
- Boost Core Incentive Protocol
- Disclosed
- Sep 20, 2024
- Source
- sherlock
The Boost ERC20Incentive contract's raffle draw seeds its pseudo-random number generator with block.prevrandao + block.timestamp, both of which are block-scoped values that a validator can partially predict or influence. Under EIP-4399, a block proposer wields …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.