Submission Details
Severity:
PuppyRaffle::getActivePlayerIndex misguides if the player is not active.
Summary
The function getActivePlayerIndex will not give accurate result if the player doesn't exist.
Vulnerability Details
If a player is not active then it returns 0, which will pretend to caller that the player is active and index is 0.
Tools Used
Manual Review
Recommendations
So, if a player is not active then it should revert with an error that the player doesn't exist instead of returning 0, which seems to misguide the caller.
Updates
Lead Judging Commences
Hamiltonite over 1 year ago
Submission Judgement Published Assigned finding tags:
getActivePlayerIndex can say a player is both entered at slot 0 and inactive
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.