Challenge: Can you identify what is wrong with this simple Solidity guessing game contract that makes it easy to cheat?

You're viewing a single thread.

5 comments

For those that want to have an actual go at it: when deploying it with hardhat for example, you can pass in Math.floor(Math.random()*1000) as the constructor argument in the deploy script, and then see if you can derive the number on the first guess.
- The formula will return a specific result of uint256 type which will be used in constructor on deployment, right? 😉
  
  Yeah, this way you don't know what the number is until you actually figure out the vulnerability.