First Flight #2: Puppy Raffle

Summary

Using on-chain data which is public to everyone is not logical when trying to have RNG.

Vulnerability Details

In selectWinner function for both calculating the winnerIndex and rarity, code uses predictable values which are msg.sender, block.timestamp and block.difficulty. Because these values can be predictable, there will not be pure randomness.

Impact

The values we want random will become predictable and could be used by malicious users.

Tools Used

Manual reading.

Recommendations

Instead of using on-chain data, use oracles like VRF from Chainlink.