getWord in XRandom.sol, produces inconsistent output

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/XRandoms.sol#L28-L32

Vulnerability details

Impact

getWord() never returns the last element and returns the element at index 0 with twice the possibility compared to others

Proof of Concept

getWord function is called from inside randomWord

function randomWord() public view returns (string memory) {
        uint256 randomNum = uint(keccak256(abi.encodePacked(block.prevrandao, blockhash(block.number - 1), block.timestamp))) % 100;
        return getWord(randomNum);
    }

the value of randomNum always will remain between 0 <= randomNum < 100

But the getWord is implemented correctly for this value range

if (id==0) {
    return wordsList[id];
} else {
    return wordsList[id - 1];
}

Here is a relationship between randomNum variable and the output of getWord function

randomNum	Output Of getWord
0	Acai
1	Acai
...	...
99	Velvet Apple

As it can be seen, wordsList[0] which is "Acai" will be returned twice and wordlist[99] which is "Watermelon" will never be returned.

Tools Used

Manual

Recommended Mitigation Steps

if (id==0) {
    return wordsList[id];
} else {
    return wordsList[id - 1];
}

Should be changed to

return wordList[id]

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as duplicate of #508

[c4-judge]

alex-ppg marked the issue as selected for report

[alex-ppg]

The Warden has illustrated that the getWord function as utilized in the operational portion of the NextGen system is flawed due to incorrect usage of the input argument.

While a correct observation, this would simply double the chance of "Acai" and render the "Watermelon" word inaccessible. Thus, the randomness of the function is affected to a small degree rendering this exhibit to be of QA (low risk).

[c4-judge]

alex-ppg changed the severity to QA (Quality Assurance)

[c4-judge]

alex-ppg marked the issue as grade-b

[c4-judge]

alex-ppg marked the issue as not selected for report