First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Attacker able to create DOS situation by entering with more number of players to run the contract out of gas

0xdark1337

Summary

The function enterRaffle() takes array of address as players to enter the raffle with as many address as he can since the logic checks for entering with atleast 4 and can go up to maximum which has a logic to check for duplicate address as,

for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

This logic compares an address inside the array with each address inside it which is an gas intensive process and if an attacker enter the raffle with maximum number of address, the contract will run out of gas leads to denial of service.

Vulnerability Details

for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

This logic which checks for duplicate is inefficient, since it will take more gas as the size of the array increases which cause the contract to denial of service.

Impact

Let's say an attacker enters with 50 elements and the logic will compare 0 with each element up to 49 which cause denial of service.

Tools Used

foundry

Recommendations

The efficient way of checking duplicates would be,

- for (uint256 i = 0; i < players.length - 1; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j], "PuppyRaffle: Duplicate player");
- }
- }
​
+ mapping(address => bool) public isAddressPresent; //storage variable
+ error Raffle__DuplicateAddress(); // add under errors
​
+ for(uint256 i= 0; i < players.length; i++){
+ if(isAddressPresent[players[i]]){
+ revert Raffle__DuplicateAddress();
+ }
+ isAddressPresent[players[i]] = true;
+ }
Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

denial-of-service-in-enter-raffle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!