First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Winner and NFT token rarity can be predicted

musashi

Summary

The winner and token rarity selection in PuppyRaffle#selectWinner() use weak PRNG to generate random values. Attackers can mimic the same PRNG to become winner and also choose their desire NFT rarity.

Vulnerability Details

These lines from PuppyRaffle#selectWinner() use public information to get winnerIndex and it's not 100% random.

uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;

This line contains the same issue but different RNG calculation to determine rarity

uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

Impact

Using weak PRNG allows attackers to become the winner and can mint themselves NFT tokens with rarity that they want.

Tools Used

Manual Review

Recommendations

Use a decentralized random generator like Chainlink's VRF service to get random values

Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.