First Flight #2: Puppy Raffle

Summary

Winner can be easily predicted.

Vulnerability Details

Due to the methodology used to pick the winner, the winner can be determined in advance of the selectWinner transaction going through.

This is demonstrated in your testSelectWinner function - where player 4 always wins.

Miner Manipulation: Miners have some degree of control over block.timestamp and can potentially manipulate it to influence the outcome.
Block Difficulty: The block.difficulty can be predicted to some extent based on network conditions.
Use of msg.sender: Including msg.sender in the randomness seed does not contribute to randomness unless you trust all participants to not be malicious.

Impact

Can be called when a user knows they have won, or, a genuine selectWinner call could could be front run to call refund if a malicious user can see they aren't going to win.

Tools Used

Manual review

Recommendations

Utilise chainlink VRF