First Flight #2: Puppy Raffle

Summary

Calling PuppyRaffle::enterRaffle with many addresses results in the user paying a very little fee and gaining an unproportional amount of entries.

Vulnerability Details

PuppyRaffle::enterRaffle does not check for an overflow. If a user inputs many addresses that multiplied with entranceFee would exceed type(uint256).max the checked amount for msg.value overflows back to 0.

To see for yourself, you can paste this function into PuppyRaffleTest.t.sol and run forge test --mt testCanEnterManyAndPayLess.

This solidity test provides an example for an entranceFee that is slightly above half the max uint256 value. The user can input two addresses and pay no fee. You could imagine the same working with lower base entrance fees and a longer address array.

Impact

This is a critical high-severity vulnerability as anyone could enter multiple addresses and pay no fee, gaining an unfair advantage in this lottery.

Not only does the player gain an advantage in the lottery. The player could also just refund all of his positions and gain financially.

Tools Used

• Manual review

• Foundry

Recommendations

Revert the function call if entranceFee * newPlayers.length exceeds the uint256 limit. Using openzeppelin's SafeMath library is also an option.

Generally it is recommended to use a newer solidity version as over-/underflows are checked by default in solidity >=0.8.0.