Summary

The selectWinner function implement two different ways of obtaining RNG. Both can be computed before hand and influenced by node operators.

Vulnerability Details

uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length
uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

• msg.sender is known

• block.timestamp is maleable by node operators

• block.difficulty is maleable by node operators

The selectWinner tx will be held until the player desired by a malicious node operator is chosen as winner.

Impact

The raffle result will be manipulated by a malicious node operator. Causing an unfair environment for the regular participants.

Tools Used

Manual review.

Recommendations

Use Chainlink VRF to make the raffle fair.