First Flight #2: Puppy Raffle

Summary

selectWinner is using keccak256 to generate a "random" number.

Vulnerability Details

using keccak256 to select a random number is not a good way to do it. it is better to use
chainlink VRF to get a random number. keccak256 is not random enough for a raffle.
Anyone who figures out how your contract produces randomness can anticipate its results and use this information to exploit your application.

Impact

Randomness is predictable and can be exploited to rig the raffle results in someone's favor

Tools Used

VSCode

Recommendations

use Chainlink VRF to generate verifiably random numbers when selecting a winner and when determining the rarity.