First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

enterRaffle no zero address modifier for newPlayers array

n4thedev01

Summary

enterRaffle function param newPlayers address array doesn't take into account if zero address is given.

Vulnerability Details

enterRaffle function allows zero address to be entered into the raffle, there is no modifier to stop this.

Impact

If the zero address was to be selected as a winner then the 80% of the contract funds would be lost as well as the NFT.
or If user accidentally entered using zero address their entering fee would be lost in the case they wanted to withdraw.

Tools Used

Manual Review

Recommendations

​
for (uint256 i = 0; i < newPlayers.length; i++) {
+ require(newPlayers[i] != address(0), "PuppyRaffle: Zero address not allowed");
players.push(newPlayers[i]);
}
​
Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

zero address can win the raffle

Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!