First Flight #2: Puppy Raffle

Summary

indexWinner is the variable which determines what address in the 'players' array wins the raffle. The value of this variable directly depends on the block.difficulty and block.timestamp variables.

Vulnerability Details

block.difficulty and block.timestamp are two variables thay may be altered by a miner (changing the hash power or delaying some seconds in mining the block, respectively), which will lead to a different value in the indexWinner variable.

Impact

The impact is medium because although not all the miners have the same power to manipulate these variables, it is enough to consider the game unfair and undesirable to play.

Tools Used

GitHub

Recommendations

Using and oracle like Chainlink, which allows to get information from the real world and get truly random numbers in a decentralised way.