First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy in refund function

theirrationalone

Summary

There's no Reentrancy guard present for refund function. As we know already there is blank spots in the players array, It becomes more important to have a defence against Reentrancy.

Vulnerability Details

refund
// Lack of protection against Reentrancy. 👇
function refund(uint256 playerIndex) public {
address playerAddress = players[playerIndex];
require(playerAddress == msg.sender, "PuppyRaffle: Only the player can refund");
require(playerAddress != address(0), "PuppyRaffle: Player already refunded, or is not active");
​
payable(msg.sender).sendValue(entranceFee);
​
players[playerIndex] = address(0);
emit RaffleRefunded(playerAddress);
}

Impact

This vulnerability can vanish the raffle prize pool. And In the end winner will get nothing also raffle producer (owner) will get 0 fee for running & conducting raffle. Adversaries (bots or somehow humans) can make a huge figure with this vulnerability.

Tools Used

Manual review

Recommendations

We can use our own logic to defend against it but why to reinvent the wheel when openzeppelin is providing that protection utility to everyone. Since everyone (WEB3 | blockchain Aspirants) trust it with 0 trust.

refund fixed
// ...
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
// ...
// ...
// ...
​
contract PuppyRaffle is ReentrancyGuard, etc {
function refund(uint256 playerIndex) public nonReentrant /* here 👈*/ { // here i added nonReentrant modifier imported from openzeppelin library.
address playerAddress = players[playerIndex];
require(playerAddress == msg.sender, "PuppyRaffle: Only the player can refund");
require(playerAddress != address(0), "PuppyRaffle: Player already refunded, or is not active");
​
payable(msg.sender).sendValue(entranceFee);
​
players[playerIndex] = address(0);
emit RaffleRefunded(playerAddress);
}
}
Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

reentrancy-in-refund

reentrancy in refund() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!