First Flight #2: Puppy Raffle

Summary

In line 140 there is a weak RNG vulnerability,
malicious miners by manipulating block.difficulty could affect the mechanism of picking a rarity and get a legendary NFT avoiding the fairness of the protocol.

Vulnerability Details

The vulnerability is accorded to rarity assigning by using the keccak256(abi.encodePacked(msg.sender,block.difficulty) to provide randomness, because the parameters could be manipulated by other sides the protocol becomes vulnerable.

Impact

High, by manipulating the rarity the attacker would always receive the legendary NFT( or the rarity he wants), decreasing the chances of other players to receive the NFT

Tools Used

slither + manual review.

Recommendations

Use chainlink VRF in order to provide truly verifiable randomness, according to the contract logic you can consider using the subscription method of providing randomness