First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Winner can be predicted

damoklov

Summary

Winner can be predicted due to certain blockchain specifics and overall code visibility.

Vulnerability Details

A variable responsible for calculating winner (winnerIndex) can be predicted since using block.timestamp is not recommended.
Also raffleDuration and raffleStartTime should not be public.

Impact

Lottery winner can be predicted.

Tools Used

Manual code analysis.

Recommendations

Consider not using block.timestamp since it can be manipulated

  • References:

  1. https://ethereum.stackexchange.com/questions/143504/blockhash-and-block-timestamp-manipulation-in-pos

  2. https://solidity-by-example.org/hacks/randomness/

You can take a look at oracles:

  1. https://fravoll.github.io/solidity-patterns/randomness.html

  2. https://fravoll.github.io/solidity-patterns/oracle.html

- uint256 public raffleDuration;
- uint256 public raffleStartTime;
+ uint256 private raffleDuration;
+ uint256 private raffleStartTime;
​
- uint256 winnerIndex =
- uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

weak-randomness

Root cause: bad RNG Impact: manipulate winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.