First Flight #2: Puppy Raffle

Summary

selectWinner is currently using on chain data to generate the winning index and can be called by anyone.

Vulnerability Details

selectWinner function (line 125-154) in PuppyRaffle.sol is currently using on chain data to generate the winning index. it uses block.timestamp, block.difficulty, msg.sender and players.length to randomize the winning index. This can easily be hacked by an externally deployed smart contract that checks for these variables and submits a TX when it's own Index would win upon submission. (Remember this function doesn't check that the caller is the msg.owner).

Impact

WARNING: HIGH POSSIBILITY OF BEING EXPLOITED UNLESS ATTENDED TO!

Tools Used

Manual inspection

Recommendations

Look into using a different way of randomizing the winning index, perhaps ChainLink vrf or similar. On chain data can easily be manipulated to get a desired outcome.