Submission Details
Severity:
Check for (0) address in enterRaffle() - Corrupted players[] array
Summary
The enterRaffle() function does not check input addresses for the (0) address. This can lead to complications in the raffle.
Vulnerability Details
A user can skirt the "4 player minimum" rule by entering array that has (0) addresses
Impact
Medium - This can lead to raffles with less players giving an unfair advantage to those left in the game. This defeats the purpose of having a minimum number of players
Tools Used
Manual inspection
Recommendations
Add a check like so:
for (uint256 i = 0; i < newPlayers.length; i++) {
require(newPlayers[i] != address(0), "PuppyRaffle: Enter with a real address");
// resume logic
}
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Assigned finding tags:
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.