First Flight #2: Puppy Raffle

Summary

The refund function, which allows players to refund their money early at any time before the end of the match, does not follow business logic

Impact

This would result in players being able to refund their refunds and withdraw from the tournament at any time at the end of the sweepstakes tournament, which could easily be exploited by an attacker for backdoor operations.

Tools Used

Manual Review

Recommendations

It is suggested that a restriction be placed on this function to only allow refunds for a certain period of time before the start of the draw. Refunds are not allowed after the start of the contest.