First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Gas expensive duplicate check in enterRaffle function causes DoS attack making subsequent participants to spend more gas when entering the raffle

luka

Summary

The function loops through the players array to check for duplicates. The longer PuppyRaffle:players array is, the more checks a new player will have to make. This means that the gas cost for players who enter at the beginning of the raffle start will have significantly lower gas costs and since a single player can enter multiple accounts at once he can gain even more advantage.

Vulnerability Details

function testReadDuplicateGasCost() public {
vm.txGasPrice(1);
​
// first 100
uint256 playersNum = 100;
address[] memory players = new address[](playersNum);
for (uint i = 0; i < playersNum; i++) {
players[i] = address(i);
}
uint256 gasStart = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * playersNum}(players);
uint256 gasEnd = gasleft();
uint256 gasUsedFirst = (gasStart - gasEnd) * tx.gasprice;
console.log("Gas cost of 1st 100 players:", gasUsedFirst);
​
// next 100
for (uint i = 0; i < playersNum; i++) {
players[i] = address(i + playersNum);
}
​
gasStart = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * playersNum}(players);
gasEnd = gasleft();
uint256 gasUsedSecond = (gasStart - gasEnd) * tx.gasprice;
console.log("Gas cost of next 100 players:", gasUsedSecond);
​
assert(gasUsedFirst < gasUsedSecond);
// Logs:
// Gas cost of 1st 100 players: 6252039
// Gas cost of next 100 players: 18067741
}

Impact

This makes it less fair for every subsequent player and since a single player can enter multiple accounts at once he can gain even more advantage.

Tools Used

Foundry

Recommendations

Consider using a mapping to check for duplicates. This would allow you to check for duplicates much more efficiently it would not be affected by the number of participants.

Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

denial-of-service-in-enter-raffle

luka Submitter
almost 2 years ago
patrickalphac Lead Judge
almost 2 years ago
Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

denial-of-service-in-enter-raffle

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

denial-of-service-in-enter-raffle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.