First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Impossible to win raffle if the winner is a smart contract without a fallback function

0xethanol

Summary

If a player submits a smart contract as a player, and if it doesn't implement the receive() or fallback() function, the call use to send the funds to the winner will fail to execute, compromising the functionality of the protocol.

Vulnerability Details

The vulnerability comes from the way that are programmed smart contracts, if the smart contract doesn't implement a receive() payable or fallback() payable functions, it is not possible to send ether to the program.

Impact

High - Medium: The protocol won't be able to select a winner but players will be able to withdraw funds with the refund() function

Recommendations

Restrict access to the raffle to only EOAs (Externally Owned Accounts), by checking if the passed address in enterRaffle is a smart contract, if it is we revert the transaction.

We can easily implement this check into the function because of the Adress library from OppenZeppelin.

I'll add this replace enterRaffle() with these lines of code:

​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
require(Address.isContract(newPlayers[i]) == false, "The players need to be EOAs");
players.push(newPlayers[i]);
}
​
// Check for duplicates
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}
​
emit RaffleEnter(newPlayers);
}
Updates

Lead Judging Commences

patrickalphac Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

smart contract wallet without fallback/receive will halt the raffle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!