First Flight #2: Puppy Raffle

Summary

Using weak source of randomness for generating winner and NFT rarity

Vulnerability Details

Winner and NFT rarity is generated by using block.timestamp and block.difficulty. The block.timestamp and block.difficulty is transparent to anyone. Malicious attacker can predict the winner and NFT rarity.

Impact

Malicious attacker can control the winner and NFT rarity and get the prize and legendary NFT.

Tools Used

manual

Recommendations

Using external sources of randomness via oracles like Chainlink VRF.