First Flight #2: Puppy Raffle

Summary

Winner and puppet rarity can be choosen by a malicious miner by manipulating the source of randomness used.

Vulnerability Details

Don't rely on block variables for randomness. A has access to those information and can manipulate those variables to choose the winner and the puppet rarity. See for example this articles:

• https://neptunemutual.com/blog/understanding-block-timestamp-manipulation/

• https://www.slowmist.com/articles/solidity-security/Common-Vulnerabilities-in-Solidity-Randomness.html

Impact

A malicious miner can win all the times and in addition choose an rare puppy.

Tools Used

Manual review

Recommendations

Generate randomness through the use of an oracle. See this article:

• https://neptunemutual.com/blog/understanding-block-timestamp-manipulation/#prevention.