First Flight #2: Puppy Raffle

Summary

Function enterRaffle can be blocked if two users are called refund or attacked called refund from two added accounts

Vulnerability Details

In enterRaffle checked that array players stored as a state variable has no duplicated addresses. However this array can contain two zero addresses if two users called refund. In this case function enterRaffle will fail in require(players[i] != players[j], "PuppyRaffle: Duplicate player"); because it contains two zero addresses.

Impact

Contract entering blockage by anyone

Tools Used

Recommendations

Skip zero addresses in duplications check