First Flight #2: Puppy Raffle

Summary

The "enteranceFee * newPlayers.length" arithmetic operation may overflow, which allows bad actors to enterRaffle() with zero cost.

Vulnerability Details

Since the PuppyRaffle contract uses solidity 0.7.6, there's no built-in arithmetic over/underflow check. The msg.value == entranceFee * newPlayers.length check in enterRaffle() could be bypassed when entranceFee * newPlayers.length overflows. For example, when enteranceFee is (1<<255), bad actors can enterRaffle() two players with zero ether due to 2*(1<<255) = (1<<256) == 0.

Impact

enterRaffle() with zero cost

Tools Used

Manual review

Recommendations

Use solidity 0.8.0 or higher