First Flight #2: Puppy Raffle

Vulnerability Details

The refund function allows players to claim a refund of their entrance fee at any time. This function does not check whether the raffle has already been drawn or whether the player calling the function has won or lost. As a result, players can participate in the raffle, wait for the outcome, and then claim a refund regardless of whether they won or lost. This flaw undermines the integrity of the raffle and can lead to financial losses for the contract owner.

Impact

• Financial Losses: Players can game the system by participating without any financial risk. This could result in financial losses for the contract owner or other legitimate participants.

• Loss of Trust: The integrity of the raffle is compromised, leading to a loss of trust from participants and potential reputational damage.

• Reduced Participation: Knowledge of this exploit would deter honest players from participating, as the raffle is no longer fair or financially viable.

Recommendations

• Restrict Refund Timing: Implement logic to restrict refunds to before the raffle draw. Once the raffle has commenced or a winner has been selected, refunds should no longer be permitted.

• Track Participation Status: Maintain a record of each player's participation status, distinguishing between active participants, those who have won, and those who have been refunded.