# ATMBlindBox: predictable fallback RNG drains 99K USD

ATMBlindBox used predictable fallback RNG after blockhash expiry, letting attacker precompute winning parity and drain 99K USD.

- Payout: Real-world hack
- Severity: high
- Program: ATMBlindBox
- Credited: DeFiHackLabs
- Disclosed: 2026-03-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/ATMBlindBox_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260319-atmblindbox
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:oracle-manipulation

**Target:** BlindBox betting contract on BSC
**Root cause:** Settlement fell back to keccak256(block.prevrandao, betId, block.timestamp) when blockhash(betBlock+2) expired, which is predictable before transaction submission.
**Steps:**
1. Place a large even-parity bet via `atm.transfer(DEAD, amount)` to create betId 0x1410.
2. Wait until blockhash(betBlock+2) expires (818 blocks later).
3. Compute `keccak256(abi.encodePacked(block.prevrandao, betId, block.timestamp)) % 16` off-chain; choose prevrandao/timestamp yielding even digit.
4. Call `blindBox.settle(betId)` with the precomputed winning inputs.
5. Withdraw ATM payout (195% of bet) to attacker.
**How found:** Attacker noticed settlement fallback used block.prevrandao and block.timestamp, which are known before transaction inclusion, allowing off-chain prediction of winning parity.
**Exploitation:** Attacker placed a large even-parity bet, waited for blockhash expiry, then precomputed the fallback RNG output using controllable block.prevrandao and timestamp to ensure a winning even digit, settled, and withdrew 195% payout.
**Insight:** When a contract falls back to block.prevrandao/timestamp for randomness after blockhash expiry, check if the attacker can simulate the exact inputs (prevrandao, timestamp) in a local fork to precompute outcomes before submitting settlement.