Root + Impact

Description

PuppyRaffle.selectWinner() in src/PuppyRaffle.sol assigns puppy rarities with thresholds that are off by one, so the actual split is 71% common, 25% rare, and 4% legendary, instead of the 70% common, 25% rare, and 5% legendary split the constants describe.

The constants and the vulnerable code are:

The rarity value is the hash modulo 100, so it can be any whole number from 0 to 99 inclusive: 100 possible values. The first check, rarity <= 70, is true for 0, 1, 2, and so on up to 70, which is 71 values, not 70. The second check, rarity <= 95, is true for the next 25 values, 71 to 95, which is correct for rare. Everything else, 96, 97, 98, and 99, is legendary, which is only 4 values, not 5. The error comes from using <= with a value that is itself counted: when a range starts at 0, <= 70 includes both endpoints, so it covers 71 numbers. The constants add up to 100, which makes the intended split look right at a glance, but the code's inclusive comparisons shift one percentage point from legendary to common.

Risk

Likelihood: High - the bias is deterministic and affects every single raffle. Every puppy minted goes through this exact calculation, so the wrong split is not a rare edge case but the normal outcome.
Impact: Low - no funds are lost and the raffle still completes, but the promised rarity distribution is wrong. Legendary puppies, which are meant to be the rarest and most desirable outcome, appear 20% less often than intended (4% instead of 5%), while common puppies appear more often than intended. Over many raffles that systematically changes how many legendary puppies exist, which affects their scarcity, their value to collectors, and the fairness of what players were told to expect when they paid to enter.

Proof of Concept

Manual trace - no tests were run; this is a step-by-step reading of the code, with a worked example.

Worked example: list all 100 possible rarity values and count which branch each one takes.

1. Values 0 to 70 inclusive: the first check, rarity <= 70, is true, so the puppy is common. Count them: 70 - 0 + 1 = 71 values, so 71% common.

2. Values 71 to 95 inclusive: the first check is false and the second check, rarity <= 95, is true, so the puppy is rare. Count them: 95 - 71 + 1 = 25 values, so 25% rare.

3. Values 96 to 99 inclusive: both checks are false, so the puppy is legendary. Count them: 99 - 96 + 1 = 4 values, so 4% legendary.

4. The three counts add up to 71 + 25 + 4 = 100, which covers every possible value, so the actual split is 71/25/4, not the intended 70/25/5. In a run of 100 raffles, the project should expect about 5 legendary puppies, but on average it will mint only about 4, and about 71 common puppies instead of 70.

Recommended Mitigation

Use strict < comparisons against the cumulative thresholds, so each range covers exactly the intended number of values, or use <= with thresholds one lower.

With that change, values 0 to 69 (70 values) are common, values 70 to 94 (25 values) are rare, and values 95 to 99 (5 values) are legendary, which matches the constants exactly.