First Flight #2: Puppy Raffle

Summary

Winner selection can be manipulated. It's not random as expected.

Vulnerability Details

While calculating the random winnerIndex to select winner, it's using block.timestamp and some other factors to create a hash, but the issue is, all variables are known beforehand, so any address can calculate the correct block number in which that will be selected as winner, and winner manipulation can happen.

Impact

Winner selection is not random, so any person can be selected as winner multiple times.

Tools Used

Manual Inspection

Recommendations

Use Chainlink VRF for generating true random numbers and use that for winner selection.