selectWinner is not really random, attacker could call at the right time for a guaranteed win
Summary
winnerIndex is the result of hash of formula of variables that is known by public, these are not really random
Vulnerability Details
Attacker could continuously check if the formula used for picking the winner index would give his/her playerIndex, and call it at that time. This is because all these variables msg.sender, block.timestamp, block.difficulty and players.length could be found out easily.
The same goes for rarity, attacker could time it so they don't just win, but they win with the best rarity
Impact
the raffle is not really random
Tools Used
Foundry
Recommendations
Use external oracle like chainlink for randomness instead
Lead Judging Commences
weak-randomness
Root cause: bad RNG Impact: manipulate winner
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.