First Flight #2: Puppy Raffle

Summary

Dangerous usage of block.timestamp. block.timestamp can be manipulated by miners.

Vulnerability Details

Location:

PuppyRaffle.selectWinner() (src/PuppyRaffle.sol#125-154) uses timestamp for comparisons
Dangerous comparisons:

• require(bool,string)(block.timestamp >= raffleStartTime + raffleDuration,PuppyRaffle: Raffle not over) (src/PuppyRaffle.sol#126)

Impact

If the winner's address is a contract, it could potentially execute arbitrary code and manipulate the contract state.

Tools Used

Audit Wizard (Slither)

Recommendations

Avoid relying on block.timestamp.