First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

selectWinner() selects winner deterministically

codehawky

Summary

The winner selection process is deterministic, so that anyone can precompute the winner locally and call selectWinner() when it yields favorable result.

Vulnerability Details

winnerIndex is computed deterministically based on a few publicly known parameters:

uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;

Attacker can compute winnerIndex locally and wait until a desirable block.timestamp to call selectWinner(). This will guarantees the attacker to be the winner if no one calls selectWinner() before.

Impact

Attacker can manipulate the winner selection process.

Tools Used

Manual review

Recommendations

Redesign winner selection process.

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!