First Flight #2: Puppy Raffle

Summary

Weak PRNG due to a modulo on block.timestamp, now or blockhash. These can be influenced by miners to some extent so they should be avoided.

Vulnerability Details

Location:

PuppyRaffle.selectWinner() (src/PuppyRaffle.sol#125-154) uses a weak PRNG: "winnerIndex = uint256(keccak256(bytes)(abi.encodePacked(msg.sender,block.timestamp,block.difficulty))) % players.length (src/PuppyRaffle.sol#128-129)"

Impact

The contract uses block.timestamp and block.difficulty for randomness which can be manipulated by miners to some extent. This could potentially be exploited to influence the outcome of the raffle.

Tools Used

Audit Wizard (Slither)

Recommendations

Do not use block.timestamp, now or blockhash as a source of randomness