First Flight #2: Puppy Raffle

Summary

In lines 129-130 there is a weak RNG vulnerability,
malicious miners by manipulating block.timestamp and block.difficulty could affect the mechanism of picking a winner and withdraw 80% of the funds which are stored in the protocol.

Vulnerability Details

The vulnerability is accorded to winnerIndex assigning by using the keccak256(abi.encodePacked(msg.sender,block.difficulty, block.timestamp) to provide randomness, because the parameters could be manipulated by ohter sides the protocol becomes vulnerable.

Impact

High, by manipulating the winners index the attacker would always receive the funds of other players, and win the lottery

Tools Used

slither + manual review.

Recommendations

Use chainlink VRF in order to provide truly verifiable randomness, according to the contract logic you can consider using the subscription method of providing randomness