Submission Details
Severity:
enterRaffle() not checking 0-size array results in DoS
Summary
No check is made for an empty array in enterRaffle().
Vulnerability Details
If an argument of enterRaffle() is a zero-size array the function gets stuck. The following test can demonstrate the issue and will basically freeze the contract:
function testCanEnterWithoutPlayers() public {
address[] memory players = new address[](0);
puppyRaffle.enterRaffle(players);
}
Impact
High. Vulnerability can be used to perform denial-of-service.
Tools Used
Manual check.
Recommendations
Revert, if an empty array is provided in args:
require(newPlayers.length > 0, "PuppyRaffle: no players");
Updates
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.