First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

selectWinner is not verifiably random when selecting a winner - results can be manipulated

coffee

Summary

The 'PuppyRaffle::selectWinner' function does not pick a verifiably random winner. Relying on properties of the Ethereum blockchain to compute a random number is considered pseudo-random and can be manipulated by miners.

Vulnerability Details

When winnerIndex is calculated it uses properties of the Ethereum blockchain such as msg.sender, block.timestamp, and block.difficulty to create a seed for the keccak256 hash function. The result is then used to compute a random index within the range of players.length.

Calculating a random number like this does provide a level of randomness; however, the data could potentially be manipulated through miner manipulation.

uint256 winnerIndex =
@> uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;

Impact

Potential manipulation of raffle winner. The winning player is picked using values that can be manipulated unfairly rather than by using a service that picks a verifiably random number.

Tools Used

-Foundry

Recommendations

Use an Oracle service such a Chainlink VRF to select a random number to determine the winner of the lottery.

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!