Submission Details
Severity:
Zero address can be considered active player
[L-4] Zero address can be considered active player
Description:
GetActivePlayerIndex method returns 0 idx for non existing entries in players array
Impact:
Low
Tools used:
manual, foundry
Proof of concept:
function testThatGetActivePlayerResultsInWrongResponse() public playersEntered {
// in modifier players entered we add 4 players - 1,2,3,4
// we check for address that is not being used for sure for example 0
address nonExistingAddressInRaffle = address(0);
uint256 idx = puppyRaffle.getActivePlayerIndex(nonExistingAddressInRaffle);
// it returns 0 which is the index of the first player
// so in the contract puppyRaffle.getActivePlayerIndex(address(0)) is the same as puppyRaffle.getActivePlayerIndex(address(1))
assertNotEq(puppyRaffle.players(idx), nonExistingAddressInRaffle);
}
Updates
Lead Judging Commences
Hamiltonite over 1 year ago
Submission Judgement Published Assigned finding tags:
refund-doesnt-reduce-players-array-size-causing-protocol-to-freeze
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.