First Flight #2: Puppy Raffle

Summary

The requirement to prevent duplicate addresses does not help contracts in any way and can be bypassed

Vulnerability Details

Duplicates check just adds extra costs, complexity to the contracts. This requirement and enforcement can easily be bypassed in the following ways

• user can input different account addresses that are in their control

• user can enterRaffle again with the same account addresses as the prior entry

Impact

This adds to the gas costs, complexity, potential DOS issues, out of gas etc by trying to check duplicates. Additionally can affect reputation of project as this requirement can be bypassed

Tools Used

Manual Analysis

Recommendations

Remove this duplicates requirements or check duplicates offline or enforce etc