First Flight #2: Puppy Raffle

Summary

getActivePlayerIndex()'s return value can be misleading for the first player of the current raffle round

Vulnerability Details

The documentation says that getActivePlayerIndex() returns 0 in case the player we are searching for is not an active player. But this does not hold if we are searching for the first player of the current raffle round which might be at index 0. This might lead to believe that the player at index 0 is not part of the current raffle.

Impact

The first player of the current raffle round cannot refund his first ticket

Tools Used

Manual review

Recommendations

Use a less ambiguous number to represent the fact that a player is not active for the current raffle round. type(uint256).max is best suitable in this case because it is so large and then reasonably feasible that players' array will never get to this size.