drlecks/ethereum-contracts

A set of real world usable contracts

ethereum-contracts's Issues

Stack Lottery is not random or secure at all!

In the Stack Lottery contract the winner is chosen when numtickets == maxTickets. Both of these variables can easily be read so someone can just wait until numtickets == maxTickets - 1 to "buy" their ticket.

Even though the numtickets and maxTickets variables are private, you can still get their current values.

Let's look at your live version: http://lottery.powdercode.com/

At the time of writing this ticket maxTickets (the 0th variable in your contract) is:

web3.eth.getStorageAt('0x1e217ADC6a6ADC16E248af109Ab7EFA4d1bb252D', 0, function() { console.log(arguments[1]); })
> 0x0000000000000000000000000000000000000000000000000000000000000011

So 17.

And numtickets (the 5th variable in your contract) is:

web3.eth.getStorageAt('0x1e217ADC6a6ADC16E248af109Ab7EFA4d1bb252D', 5, function() { console.log(arguments[1]); })
> 0x0000000000000000000000000000000000000000000000000000000000000000

So 0.

So luckily nobody was stupid enough to play this game yet :)