First Flight #2: Puppy Raffle

Summary

In selectWinner function, on chain approach is used to select winner, which is highly risky as the used variables to calculate randomness can be manipulated by miners leads to predictable result and one person winning again and again.

Vulnerability Details

The smart contract selects raffle winners using keccak256(abi.encodePacked(...)) , with input data that includes block.timestamp and block.difficulty. These values are not suitable for generating secure random numbers because:

• block.timestamp can be influenced by miners, leading to predictable results.

• block.difficulty changes slowly over time, reducing randomness.

Impact

If rewards are decent enough, Miner will manipulate the values to his favour to win the pot.

Tools Used

Manual Review

Recommendations

Using an external Oracle like Chainlink VRF is recommended to generate randomness. This will ensure that lottery works in transaparent way without being the risk of manipulation.