First Flight #2: Puppy Raffle

Summary

Failure to do a maximum number check on newPlayers in the enterRaffle function has potential DOS hazards, as well as hazards that increase the probability of drawing a rare NFT yourself.

Impact

1. because this function does not do a maximum number of player account addresses, it causes the same player, to add a large number of their own account addresses.

2. Malicious attackers will use this opportunity to create a large number of accounts to enter the lottery, which will lead to a DOS and also increase the probability of drawing a rare NFT for themselves.

3. sorry for the POC I won't be writing it for a while~

Tools Used

Manual Review

Recommendations

It is recommended to make a maximum limit on the number of player addresses, as well as whitelisting player addresses. This will effectively prevent both of these hazards.