First Flight #2: Puppy Raffle

Summary

The refund function in the PuppyRaffle contract could potentially lead to an inconsistent contract balance due to the unchecked return value of the sendValue function.

Vulnerability Details

The sendValue function is used to refund the entrance fee to the player and do the subsequent logic that by defaul is subtracting the balance.

• But this function does not check wether if the refund went through or not

• If this function call fails, it returns false, but this return value is not checked in the code. This can lead to inconsistencies in the contract's balance, as the contract's state is not rolled back and the entranceFee is not refunded to the player.

PoC

Attacker may call an intentional malicious contract to fail the transaction by attempting a false refund:

Impact

An inconsistent contract balance can cause issues with subsequent operations that rely on accurate balance tracking. This could disrupt the operation of the raffle when is distributing the prize pool and potentially lead to a loss of trust in the contract.

Recommendations

To mitigate this vulnerability, it is important to check the return value of the sendValue function and handle any potential failures appropriately. This could involve reverting the transaction or logging an error message. Additionally, consider using the transfer function instead of sendValue, as transfer automatically reverts the transaction if the call fails.

Correct way to use sendValue

The sendValue function returns a tuple with a success boolean and a data field. You can use the success boolean to check if the refund was successful. If it was, you can proceed with your logic. If not, we revert the transaction with an error message.

By doing this, you ensure that the transaction will revert in case of a failure, preventing potential vulnerabilities like inconsistent balances.