First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy In Refund Will Drain Funds

funkornaut

Summary

The refund function can be exploited by a Reentrancy attack and drain all the ETH from the Raffle.

Vulnerability Details

The refund function resets the players[playerIndex] AFTER it sends ether to the msg.sender. This opens up a reentrancy attack vector. Assuming msg.sender a smart contract and has entered the raffle and knows it's index within the players array. The contract can use a recieve function that calls refund it is allowed to reenter the function and receive extra ether. They can repeat this until they have drain the raffle of all ether.

function refund(uint256 playerIndex) public {
address playerAddress = players[playerIndex];
require(playerAddress == msg.sender, "PuppyRaffle: Only the player can refund");
require(playerAddress != address(0), "PuppyRaffle: Player already refunded, or is not active");
​
payable(msg.sender).sendValue(entranceFee);
​
players[playerIndex] = address(0);
emit RaffleRefunded(playerAddress);
}

Impact

Loss of all ether locked in the PuppyRaffle contract

Tools Used

Manual Review

Recommendations

Use the Checks, Effects, Interactions flow with functions that send ether. For this function move the players[playerIndex] = address(0); before the line payable(msg.sender).sendValue(entranceFee);

function refund(uint256 playerIndex) public {
address playerAddress = players[playerIndex];
require(playerAddress == msg.sender, "PuppyRaffle: Only the player can refund");
require(playerAddress != address(0), "PuppyRaffle: Player already refunded, or is not active");
​
+ players[playerIndex] = address(0);
payable(msg.sender).sendValue(entranceFee);
​
- players[playerIndex] = address(0);
emit RaffleRefunded(playerAddress);
}
Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

reentrancy-in-refund

reentrancy in refund() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!