# Almost all rarity rank combinations cannot be, and are not uniformly, generated

AI Arena's DNA-to-rarityRank modulo divisors produce only 0.0002427% of possible rank combinations, with 24% twice as likely, biasing attribute generation.

- Payout: Contest reward
- Severity: medium
- Program: AI Arena
- Credited: d3e4
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-ai-arena-findings/issues/1979
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** AiArenaHelper.createPhysicalAttributes rarity rank derivation
**Root cause:** Each rarityRank is computed as (dna / divisor) % 100 with divisors [2,3,5,7,11,13]; the six ranks are correlated functions of a single dna value, so the vector repeats every 3,003,000 integers and only 2,427,000 distinct combinations exist, with 576,000 duplicated.
**Steps:**
1. Read AiArenaHelper.createPhysicalAttributes: `rarityRank = (dna / attributeToDnaDivisor[attributes[i]]) % 100` with divisors [2,3,5,7,11,13].
2. Note the six ranks are all derived from the same dna, so the vector repeats with period 2*3*5*7*11*13*100 = 3,003,000.
3. Observe dna=0 and dna=1 both yield [0,0,0,0,0,0]; dna=16 and 17 both yield [8,5,3,2,1,1]; dna=22 and 23 both yield [11,7,4,3,2,1].
4. Count distinct combinations: 2,427,000 of 100^6 possible, with 576,000 appearing twice (~24% double probability).
**How found:** Code reading of the rarityRank formula; noticed all six ranks derive from one dna via fixed divisors, then computed the repetition period and duplicate count to quantify the bias.
**Insight:** When deriving multiple independent random values from one seed, dividing by distinct small divisors creates correlated outputs; check the period (product of divisors * modulus) and count collisions to prove non-uniformity.