Forgeries contest - cccz's results

Lines of code

https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/VRFNFTRandomDraw.sol#L173-L174

Vulnerability details

Impact

In VRFNFTRandomDraw, only the owner is allowed to call startDraw for the draw, which means that if the owner does not call the startDraw function, the draw will be invalid. A malicious owner can perform a draw fraud.

    function startDraw() external onlyOwner returns (uint256) {

Consider the following scenario User A creates a VRFNFTRandomDraw contract and declares that a draw will be made among the holders of "ANFT" and the winner will receive a BAYC. As a result, the price of "ANFT" rises due to speculation and User A takes the opportunity to sell his "ANFT". However, since the startDraw of the VRFNFTRandomDraw contract can only be called by User A, User A can choose not to call it and thus perform the draw fraud

Proof of Concept

https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/VRFNFTRandomDraw.sol#L173-L174

Tools Used

None

Recommended Mitigation Steps

Consider sending the NFT to the contract when creating the contract, and set a deadline to allow the DrawingNFT holder to call startDraw after expiration