artgobblers/art-gobblers

๐Ÿ”’ Chainlink double reveal

transmissions11 opened this issue ยท 0 comments

this is asynchronous:

https://github.com/FrankieIsLost/art-gobblers/blob/c2389e78aba84c8a9cb044bcefca531f958fb56b/src/ArtGobblers.sol#L457

so we'll have set all the state above without actually setting a new seed, then someone can call revealGobblers in the meantime while we're waiting for that new seed

could set randomSeed to 0 and check its non zero in revealGobblers or add a waitingForSeed boolean to the reveal data struct:

https://github.com/FrankieIsLost/art-gobblers/blob/c2389e78aba84c8a9cb044bcefca531f958fb56b/src/ArtGobblers.sol#L125

there's technically a teeny tiny risk randomSeed is set to 0 correctly by Chainlink VRF, so probably best to avoid magic values there