Blast the balloon SC Audit
When a user buys a spin for a round, he must also supply a random number that will be used by pyth in the generation of the final random number. The final random number is used to determine if the user has won any prise. The user supplied random number will be used to determine which position in the master baster will be used if the spin is a master blaster win.
There are a finite number of blast master winning spots 10 by default. Each spot to be taken by a winner is determined by the calculation
uint blastMasterWinningPosition = userRandomNumber % roundInfo.maxBlastMasterWinners;
and if another player already has that spot occupied, his winnings will be removed.
Since user controls the userRandomNumber number, he can preset it to take the position of another player, to not only win but to also inflict losses for the other player. This is also incentivize from a game-theory point of view as the fewer positions that occupy the blast master winnings the more rewards will overflow to the next round.
If we consider all players as logical actors, after the first player won a position, all other actors will modify their random to take his position. By doing it as so, the major pot reward amount that will be passed in the new round will be higher, and they will have an extra change of winning a part of it.
Use the pyth random number (winningPosition) to calculate the blast master position instead of the user provided random number.
Blast the balloon SC Audit