Submission Details
Severity:
There is no variable to track winner address to NFT
Summary
No variable in this contract tracks previous winners. previousWinner gets overwritten each time a lottery is run.
Impact
You don't have an orderly record of the previous winners. If someone comes to you and says that they won a raffle but didn't get their NFT or their money, you won't be able to verify that because everything gets overwritten and you don't have a record of who won that raffle. You only have tokenIdToRarity but that doesn't help you in terms of who won.
Tools Used
Manual review
Recommendations
Add a mapping for tokenIdToWinner:
mapping(uint256 => address) public tokenIdToWinner;
Update it when you update state in the selectWinner function:
tokenIdToWinner[tokenId] == previousWinner;
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.