First Flight #2: Puppy Raffle

Summary

If a player refunds, the value of their address in the array is changed to address(0) but the size of the array does not decrease.

Vulnerability Details

The contract keeps track of the players who have entered the raffle with an array. When the refund is requested, the value is returned to the user, and their address in the array is set to address(0), however, the size of the array is not decreased.

When it's time to select a winner, the contract tries to calculate the payout by the size of the players array, multiplied by the entrance fee. If anyone's requested a refund, there's not going to be enough funds to payout compared to what the calculation is going to expect.

Impact

Critical

Tools Used

Foundry

POC

Recommendations

There are multiple ways to solve this problem. One would be to remove the item from the array altogether so that the size is equivalent to the number of players registered.

Alternatively, keep track of the balance in the raffle in a separate variable, and decrease or increase this variable after a player enters/leaves the raffle and use this to calculate the payout.

Also, it'd be better to use mappings to keep track of the users status rather than relying on arrays which can cause other problems such as the array growing too large for example.