ETH_roulettetech_audit_report.md

roulette.tech audit report.

1. Summary

This document is a security audit report performed by danbogd, where roulette.tech has been reviewed.

2. In scope

Сommit hash c63e338983878924c266e54d07412d3be3842aff.

• FlatBetherRoulette.sol.
• RouletteMatrix.sol.

3. Findings

In total, 1 issues were reported including:

• 1 high severity issues
• 0 low severity issues
• 0 owner privileges (ability of owner to manipulate contract, may be risky for investors)..
• 0 notes.

No critical security issues were found.

3.1. Unsafe rundom number.

Severity: high

Description

Formula of the random calculation is:

    function getRandomNumber(address player, uint256 playerblock, uint256 settleBlock) private view returns (uint8 wheelResult) {
    
    bytes32 blockHash = blockhash(playerblock + blockDelay);
    require(blockHash != 0);
    bytes32 shaPlayer = keccak256(abi.encodePacked(keccak256(abi.encodePacked(player, blockHash)), blockhash(settleBlock - 1)));
    wheelResult = uint8(uint256(shaPlayer) % 37);

}

The attacker can choose the necessary values of this variables to win with absolute probability.

Code snippet

https://github.com/smartgametech/callistoroulette/blob/c63e338983878924c266e54d07412d3be3842aff/contract/FlatBetherRoulette.sol#L460-L470

Recommendation

Use another mechanism of random number calculation.

4. Conclusion

The audited smart contract is not safe to deploy, high severity issue was found.