First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Refund to players can drain all the funds

0x0bserver

Summary

Refund to players in function refund causes Reentrancy Attack.

Vulnerability Details

payable(msg.sender).sendValue(entranceFee);
players[playerIndex] = address(0);

In function refund, sendValue send the funds to msg.sender but msg.sender can call in the same function in the same transaction, which results in executing the whole refund function again. Thus, getting the entranceFee again. This process can be repeated continuously until all the funds are drained from the contract.

Impact

@> players[playerIndex] = address(0);

Attacker can drain all the funds by calling the refund function continuously as the state reset as shown above is after the sendValue function.

Tools Used

Manual Review

Recommendations

Transfers should always be at the bottom of the function to defend again Reentrancy Attacks.

- payable(msg.sender).sendValue(entranceFee);
- players[playerIndex] = address(0);
+ players[playerIndex] = address(0);
+ payable(msg.sender).sendValue(entranceFee);
Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

reentrancy-in-refund

reentrancy in refund() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!