First Flight #11: Snek-Raffle

Summary

The winner gets a snek NFT minted on the basis of rarity of the snek via a random number derived by the chainlink VRF.

Every snek has their own chances of getting associated with them, which are mentioned by the protocol, there total sum being 100, therefore the random number was expected to be modulo by 100, in order to get the chances in the respective ranges limit but instead the actual implementation performs a modulo of 3 which is kind of irrelevant and breaks the protocol rule's to get the snek.

Vulnerability Details

• The vulnerability occurs while allocating the random snek to the Raffle winner because of incorrect implementation to allocate the snek, as it does not follow the said percentage chances distribution of snek as mentioned by the protocol.

• The total % sum up to 100, therefore in order to get the randomness in the specified ranges, the random number derived via chainlink VRF should be modulo by 100.

• But in the current implementation it performs modulo by 3 resulting into 3 numbers only -> 0, 1 or 2. As a result of which the chances of getting every snek is equally likely, which doesn't actually follow the said rules.

Impact

The protocol mentions to have custom chances of getting the respective NFT but current implementation makes getting every NFT as equally likely.

Tools Used

Manual Review

Recommendations

Implement the said custom chances distribution for the respective snek.