First Flight #2: Puppy Raffle

Summary

Vulnerability Details

Generating randomness in Ethereum is challenging because every node must come to the same conclusion on the state of the blockchain. Hence, naive approaches to generate randomness can be manipulated by validators or observant attackers. This can lead to unfair advantages in the game.

Impact

Insecure randomness can be exploited by attackers to gain an unfair advantage in PuppyRaffle draw because it rely on random number generation using block.timestamp which can be manipulated by validators.

Tools Used

Manual Review

Recommendations

Use external oracle services that provide random numbers.