First Flight #2: Puppy Raffle

Summary

Using block.timestamp and block.difficulty as sources of randomness is strongly discouraged, as the outcome can be manipulated and predicted by an attacker.

Vulnerability Details

The randomness generation inside the selectWinner() function, both for the winnerIndex and rariry, is vulnerable since we don't use an oracle to obtain it from outside the blockchain. An attacker can manipulate this to obtain a very rare NFT or even ensure their victory.

Impact

An attacker can consistently predict or even secure their victory, and they can also anticipate the type of NFT they will receive.

Tools Used

Manual Review

Recommendations

Consider implementing a decentralized oracle for generating random numbers, such as Chainlink's VRF.