Submission Details
Severity:
Unused and bad implementation of PuppyRaffle::_isActivePlayer function
Summary
PuppyRaffle::_isActivePlayer function not being utilized is causing other severe vulnerabilities.
Vulnerability Details
The PuppyRaffle::_isActivePlayer function is never called and if it is it can only check if msg.sender is an active player which is not sufficient to prevent some of the other reported vulnerabilities.
Impact
This function not being used is causing other severe vulnerabilities.
Tools Used
Foundry
Recommendations
Call the function where it's important that the user is an active participant of the raffle in PuppyRaffle::selectWinner and PuppyRaffle::enterRaffle functions.
-- function _isActivePlayer() internal view returns (bool) {
++ function _isActivePlayer(address player) internal view returns (bool) {
for (uint256 i = 0; i < players.length; i++) {
-- if (players[i] == msg.sender) {
++ if (players[i] == player && players[i] != address(0)) {
return true;
}
}
return false;
}
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.