Insufficiently random number generation in selectWinner could lead to manipulation of raffle winner and NFT to be minted
Summary
Insufficiently random number generation in selectWinner could lead to manipulation of raffle winner and NFT to be minted by a miner. This could lead to potential entrants choosing to not enter the raffle due to potential for rigged drawings.
Vulnerability Details
The usage of block.timestamp and block.difficulty in selectWinner to determine the raffle winner and NFT to be minted is problematic due to the ability of a miner to manipulate those values to achieve a desired outcome.
Impact
High - would have a detrimental effect on the protocol's usage as many potential entrants will be reluctant to enter.
Tools Used
VS Code
Slither
Recommendations
Utilize an external source of randomness, such as Chainlink VRF
Lead Judging Commences
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.