How do I roll the attack & damage for Violet Fungus?

Question

I have an encounter with a few Violet Fungus clinging to the walls. I've read over their statblock a few times but still have concerns regarding how to roll attack and damage for their Rotting Touch attack.

Multiattack. The fungus makes 1d4 Rotting Touch attacks.

Rotting Touch. Melee Weapon Attack: +2 to hit, reach 10 ft., one creature. Hit: 4 (1d8) necrotic damage.

I roll a 1d4 to determine how many Rotting Touch attacks it does. I roll a d20 for each Rotting Touch to see which ones will hit. However, what modifiers am I adding for the attack roll and the damage roll? Based on the ability scores, if I use STR (melee weapon attack) for the attack roll and the damage roll it seems like a rather ineffective attack. STR is 3 (-4) and DEX is 1 (-5).

The lowest AC in my party is 10, followed by two 14s and two 18s. I'd always have to roll a 12 or higher to hit the AC 10. 16 to hit the AC 14, and a nat 20 to hit AC 18. On top of that I'd then roll a 1d8 and subtract 4 from the damage?

Is it really a d20 - 4 (STR) + 2 to hit with the Violet Fungus? And a 1d8 - STR for the damage?

Answer 1

You don't apply an ability score to monster attacks unless stated.

The attacks on a monster's page contain everything you need when rolling for that monster.

In this case, the Rotting Touch attack doesn't use an ability score to attack. It has a flat +2 to hit, followed by +0 to damage, and nothing more or less. You would roll a d20 and add 2 to the result for the attack roll. On a hit, you would roll a 1d8 and add nothing to it, and that would be the damage.

Answer 2

The Fungi are exceptions to a general rule.

The idea of calculating a creature's attack rolls and damage from their ability scores and proficiency is generally correct. The attack bonus for most monsters in the MM is their attack modifier (STR or DEX) plus the appropriate proficiency modifier.

For example, the Formorian that appears right before the fungi does have its attacks calculated that way: +9 to hit, which is +6 from strength and +3 from a CR 8 proficiency mod, and its damage gets a +6 from strength.

However, there are exceptions to those general rules, and in those cases, you follow the listed stat block as written, because specific overrides general. As you point out, for the fungi, the attacks are not based on ability scores. You go with whatever the stat block states: in this case, a +2 to attack, even though it's not consistent with the listed ability scores. For this case, it looks like the Violet Fungus does not suffer any penalty for its negative ability scores, and only gets its +2 proficiency bonus from CR.