weak-sources-randomness

Detect weak randomness vulnerabilities in Solidity by analyzing code patterns for deterministic on-chain data like block.timestamp, blockhash, or block.number used in random number generation. This Skill pinpoints insecure patterns and provides remediation guidance.

Using block.timestamp or blockhash for randomness is an exploit risk because these on-chain values are predictable and manipulable by miners. Attackers can influence block attributes to control outcomes in critical economic functions like lotteries.

Secure alternatives to on-chain random number generation include integrating Chainlink VRF for verifiable randomness or implementing commit-reveal schemes. This Skill suggests these solutions to replace deterministic block attributes in Solidity code.

Audit a decentralized lottery smart contract for randomness exploits by scanning the Solidity code for insecure random number generation. This Skill identifies exploitable deterministic data usage and offers secure remediation strategies.

Using this Skill requires understanding of Solidity, common smart contract exploits, and blockchain-specific data. This foundational knowledge is necessary to interpret the vulnerability detection results and apply the suggested remediation effectively.