First Flight #2: Puppy Raffle

Summary

Malicious miners can predict the raffle result

Vulnerability Details

selectWinner uses block.timestamp and block.difficulty to determine the winner.

While the block variables may be unpredictable, it is still determined by the miners who are adding blocks to the blockchain, and an attacker may be able to influence the difficulty and predict the output of this function.

Impact

Malicious miners will keep trying to generate Randomness until they acquire the desired result, with which they will then broadcast a block or an attacker may be able to influence the difficulty and predict the output of this function.

Tools Used

Manual review.

Recommendations

Increase randomness and unpredictability by generating random numbers through the participation of multiple parties or by using an oracle.