First Flight #2: Puppy Raffle

Summary

selectWinner can be called by anyone, which allows a player to decide who gets to be a winner.

Vulnerability Details

selectWinner uses block.difficulty and block.timestamp to calculate the winner. selectWinner can only be called after the raffle ends however at which the block the function is called is important but since anyone can call it. A player might wait for the right block and call it when the calculation results in the player itself as the winner and thus claim the prize.

Impact

Players have the power to decide the winner by making the call to selectWinner function at the right block.

Tools Used

Manual

Recommendations

Only allow the owner to call the function, and use VRFs to generate verifiable randomness to calculate the winner.