First Flight #2: Puppy Raffle
In this article, we continue with our series of CodeHawks Articles, where we delve into the weekly contests of FirstFlight. On this occasion, we will take a deep dive into the NFT raffle protocol. We will unravel its code, analyze its structure, and explore how this protocol is transforming the experience of participating in NFT raffles. Additionally, we will address the various vulnerabilities we have identified and provide a detailed insight into how to tackle these challenges.
H-01 | Reentrancy in function refund
Relevant GitHub Link
Description: One of the key issues we discovered during our in-depth evaluation of the NFT raffle protocol is the presence of a significant vulnerability in the refund function. This vulnerability poses a considerable risk, as it allows a malicious user to withdraw all the funds from the contract. The root of the problem lies in the failure to implement the “Checks-Effects-Interactions” pattern in the refund function, creating a security gap in the protocol.
In order to test and validate the presence of the vulnerability identified in the refund function, we have developed a specific contract called PuppyRaffleAttack. This contract is designed to simulate an attack scenario, allowing us to test and understand the extent of the risk posed by the vulnerability.
Using this proof of concept (POC), we have been able to illustrate how an attacker could exploit the flaw in the refund function and access the funds of the NFT raffle contract.
Resolution: To address the vulnerability identified in the refund function and strengthen the overall security of the NFT raffle protocol, it is crucial to implement a series of key improvements. First and foremost, it is imperative to strictly follow the “Checks-Effects-Interactions” pattern in the refund function, which helps ensure proper processing of pre-checks, execution of operations, and subsequent interactions.
Get Pol Gallardo’s stories in your inbox
Join Medium for free to get updates from this writer.
Furthermore, an additional layer of protection is essential to prevent reentrancy attacks, for which the integration of well-audited security libraries such as OpenZeppelin is recommended.
H-02 | Attacker can compute deterministic winner
Relevant GitHub Link
Description: Another significant weakness we have identified in the NFT raffle protocol is the predictable nature of the winnerIndex calculation. The lack of randomness in this process poses a potential risk, as an attacker could anticipate the value of the winnerIndex and manipulate the system to ensure that, when calling selectWinner(), they always win the prize prizePool.
The calculation of winnerIndex is deterministic, meaning that no source of randomness is used in the process. The attacker can access and control various variables that affect this calculation, including the attacker’s address (msg.sender), the block timestamp (block.timestamp), the block difficulty (block.difficulty), and the length of the list of participants (players.length), which can be controlled by manipulating the entries.
Furthermore, the selectWinner() function can be invoked by anyone willing to pay the gas cost, further increasing the exposure to risk.
In order to validate the presence of the vulnerability identified in the winner selection function, we have created a specific contract called PuppyRaffleWinnerAttack. This contract inherits the IERC721Receiver interface to allow for NFT reception. The structure of the contract has been strategically designed to simulate a potential attack scenario, enabling us to test and understand the true extent of the risk posed by the vulnerability.
Through the use of this proof of concept (POC), we have successfully demonstrated how an attacker could leverage the weaknesses present in the refund function and potentially gain access to the funds stored in the NFT raffle contract. By simulating the actual conditions of a possible attack, we have accurately illustrated the severity of the risk posed by the vulnerability identified in the protocol.
Resolution: To address the vulnerability identified in the winner selection function, it is essential to implement a more secure and reliable approach to ensure fairness and randomness in the selection process. In this regard, we propose restricting access to the selectWinner() function only to a designated guardian that provides a secure randomness oracle for the winner calculation.
Here is my small contribution to the discovery of these two significant vulnerabilities in Puppy Raffle! We eagerly await the next challenge that First Flight will bring, to continue uncovering and resolving potential vulnerabilities on their platform.
