First Flight #2: Puppy Raffle

Summary

Winner is selected using weak randomness i.e block.timestamp and block.difficulty, which results in unfair draw of winner.

Vulnerability Details

A function selectWinner() is called for selecting winners that uses a combination of msg.sender, block.timestamp, and block.difficulty which is considered a weak randomness as it is visible on the blockchain and it can be influenced by other players.

Impact

Any one can choose winner of the raffle.

Tools Used

Manual Review

Recommendations

Use randomness that has lower level of predictability.