First Flight #2: Puppy Raffle

Vulnerability Details

The selectWinner() function uses the sender's address, the current timestamp, and the block difficulty as input to the keccak256() hash function to calculate the winnerIndex and rarity. This is a pseudo-random number generator (PRNG), which means that it is not truly random. An attacker could control the winner's index and rarity by mining their own blocks and setting the block difficulty to a specific value, or by sending a transaction to the smart contract at a specific time.

Impact

An attacker could exploit this vulnerability to control the winner of the game and the rarity of the prize. This could allow the attacker to win the game themselves or to give themselves a higher chance of winning.

Tools Used

Recommendations

Use a secure channel to generate randomness like Chainlink VRF.