First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Blank spots in array will result in Denial of Service(DOS)

0x0bserver

Summary

Blank spots in array players will result in Denial of Service if new players try to participate by calling enterRaffle function.

Vulnerability Details

When any 2 users/player use refund function, it will create 2 blank spots in the players array.

players[playerIndex] = address(0);

After 2 blank spots are created in the array, if any new player calls enterRaffle function to participate in the raffle, that player won't be able to do so, as line mentioned below will result in true by matching 2 blank spots.

require(
@> players[i] != players[j],
"PuppyRaffle: Duplicate player"
);
​

Impact

New players won't be able to participate in the PuppyRaffle after 2 blank spots are created in the players array.

Tools Used

Manual Review

Recommendations

Updates

Lead Judging Commences

Hamiltonite Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

refund-doesnt-reduce-players-array-size-causing-protocol-to-freeze

zero address can win the raffle

Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.