First Flight #2: Puppy Raffle

Summary

There's a bad logic implementation in the getActivePlayerIndex() function, that vulnerability enables the first to enter the raffle to get refunded whenever he wants.

Vulnerability Details

• Initial State: Protocl is depolyed.

• Step 1: The attacker is the first to enter the raffle, his index is 0

• Step 2: The attacker creates a malicious contract to call the getActivePlayerIndex() by passing in argument the address of - the malicious contract that will not be found.

• Step 3: A bad implementation of the getActivePlayerIndex() will return 0 when the address will not be found.

• Step 4: The malicious contract will impersonate the attacker's initial address to be able to get a refund

Impact

The attacker can get refunded not just twice but a lot more if he creates other malicious contracts

Tools Used

Manual analysis

Recommendations

Modify the getActivePlayerIndex() for it to return -1 instead of 0 when the address is not found