First Flight #2: Puppy Raffle

Summary

The smart contract uses block.timestamp and block.difficulty as sources of randomness, which are manipulatable by miners to some extent.

Vulnerability Details

The selectWinner function uses keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty)) to determine the winner and the rarity of the NFT. Miners could potentially manipulate block.timestamp and block.difficulty to favor a particular outcome.

Impact

An attacker could gain an unfair advantage in the raffle, undermining the integrity of the game.

Tools Used

Manual Code Review

Recommendations

Use a more secure source of randomness like Chainlink VRF