First Flight #2: Puppy Raffle

Summary

Inside the 'selectWinner' function we have a logic bug when we are categorizing the different levels of rarity.

Vulnerability Details

'uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
if (rarity <= COMMON_RARITY) {
tokenIdToRarity[tokenId] = COMMON_RARITY;
} else if (rarity <= COMMON_RARITY + RARE_RARITY) { // @audit-issue This should be 'rarity > COMMON_RARITY + <= RARE_RARITY'
tokenIdToRarity[tokenId] = RARE_RARITY;
} else {
tokenIdToRarity[tokenId] = LEGENDARY_RARITY;
}'
Here you can see the logic flaw being found when we are categorizing the rarity levels.
It should be 'else if (rarity > COMMON_RARITY + <= RARE_RARITY)' instead of 'else if (rarity <= COMMON_RARITY + RARE_RARITY)'

Impact

Medium as this could lead to a COMMON_RARITY being classified as a RARE_RARITY nft.

Tools Used

Vs Code

Recommendations

Use 'else if (rarity > COMMON_RARITY + <= RARE_RARITY)' instead of 'else if (rarity <= COMMON_RARITY + RARE_RARITY)'