Submission Details
Severity:
withdrawFees function can be DOS'd by sending ether to the contract
Summary
withdrawFees function can be DOS'd by sending ether to the contract.
Vulnerability Details
Don't rely on strict equality when comparing balances. If a malicious actor send 1 wei to the contract using selfdestruct the withdrawFees function is DOS'd.
Impact
Fee address can't withdraw fees anymore.
Tools Used
Manual review
Recommendations
Use this to check if there are active players.
require(players.length == 0, "PuppyRaffle: There are currently players active!");
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Assigned finding tags:
greifers-send-money-to-contract-to-block-withdrawfees
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.