## Weak pseudo-random number generation

**Severity**: `Med`
**ID**: `weak-prng`

Flags randomness-like expressions that directly derive entropy from predictable on-chain values.

### What it does

Reports direct use of `block.timestamp`, `block.number`, `block.coinbase`, `blockhash(...)`,
`block.prevrandao`, or `block.difficulty` in modulo expressions or `keccak256(...)`. `abi.encode*`
calls are treated as entropy only when they feed one of those expressions.

`block.difficulty` is included for legacy code. On proof-of-stake chains it is equivalent to
`block.prevrandao` and has been deprecated since Solidity 0.8.18.

### Why is this bad?

Block data is visible before transaction execution and can often be influenced or withheld by a
block proposer. Hashing or applying modulo to these values does not make them unpredictable, so an
attacker may be able to bias outcomes such as lotteries, mints, or game mechanics.

Use a commit-reveal scheme, an oracle such as a VRF, or another protocol designed for
unpredictable randomness.

### Example

#### Bad

```solidity
uint256 winner = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % players.length;
```

#### Good

```solidity
// Example shape only: consume randomness that was committed before it was revealed.
uint256 winner = uint256(keccak256(abi.encodePacked(revealedSeed, msg.sender))) % players.length;
```

### Notes

This lint is intentionally local and conservative. It does not attempt interprocedural taint
tracking, so values copied into a variable before use may require manual review.

The lint ignores obvious day-sized time-bucketing expressions such as `block.timestamp % 1 days`,
`block.timestamp % 86400`, and `block.timestamp % (24 * 60 * 60)`. The exception only applies when
`block.timestamp` is the left-hand side and the right-hand side evaluates to a constant that is at
least one day and a whole-day multiple. Sub-day buckets such as `block.timestamp % 1 minutes` or
`% 600`, reversed forms such as `1 days % block.timestamp`, and variable moduli such as
`block.timestamp % period` are still reported because the lint cannot infer whether they are
durations or randomness upper bounds.

Only Solidity expressions are inspected. Inline assembly/Yul entropy sources such as `timestamp()`
or `number()` are out of scope.