The method used in generating random numbers is susceptible to attacks
Summary
The method used in generating the random number in L127 of the PuppyRaffle contact (uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;) is not secure. For instance, in a situation were the amount to be won in the raffle is high, it might incentivize node operators to engage in the raffle. A node operator can easily front-run at different intervals and also public to only his own node until he wins the raffle making it unfair to all other entrants.
Vulnerability Details
Impact
Tools Used
Manual Review
Recommendations
Lead Judging Commences
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.