First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Using block properties as a source of pseudorandomness can allow an attacker to manipulate the generated value.

rapstyle

Summary

The PuppyRaffle::selectWinner function to choose the winner generates a random number using the block data (block.timestamp and block.difficulty). This technique is not safe.

Vulnerability Details

The PuppyRaffle::selectWinner function calculates the value of winnerIndex via block.timestamp and block.difficulty.

function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
@> uint256 winnerIndex =
@> uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];

The same method is also used to calculate the rarity of the NFT to be mined.

// We use a different RNG calculate from the winnerIndex to determine rarity
@> uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

Using block data to generate random numbers in Solidity can be risky and potentially vulnerable to miner manipulation or front-running attacks. This is because the block value can be influenced or known by transaction participants.

Impact

The impact is high because an attacker exploiting this vulnerability could win every match.

Tools Used

  • Foundry

  • Manual check

Recommendations

To generate random numbers more securely in Solidity, it is recommended that you use external entropy sources or trusted random number generation contracts, such as the Chainlink VRF random number generator.

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!