First Flight #2: Puppy Raffle

Summary

Prize rarity depends on msg.sender address

Vulnerability Details

block.difficulty == 0 always in PoS. So the rarity of the prize token depends only on the msg.sender that calls the selectWinner() function:
uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

Impact

What rarity of prize token depends exclusively on who calls the selectWinner() function.

Tools Used

Manual review

Recommendations

Use actual randomness -> Chainlink VRF