Submission Details
Severity:
Forcefully sending ether can DoS withdrawFees()
Summary
Attacker can forcefully send ether to the contract to DoS withdrawFees().
Vulnerability Details
withdrawFees() checks if contract's balance is equal to totalFees:
function withdrawFees() external {
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
...
}
Attacker can forcefully send ether to the contract via selfdestruct(), even 1 wei suffices. That extra ether will make address(this).balance > uint256(totalFees) so that the require statement will always revert, therefore put withdrawFees() into DoS state.
Impact
Fees will be stuck in the contract.
Tools Used
Manual review
Recommendations
Use other methods to check if there are still active players.
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Assigned finding tags:
greifers-send-money-to-contract-to-block-withdrawfees
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.