First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

PuppyRaffle::withdrawFees DOS due to strict equality of balance validation

priker

Summary

  • An attacker can cause denial of service by frontrunning the withdrawFees tx by sending 1 wei and causing the ether balance to change and not equal to the totalFees in PuppyRaffle.withdrawFees()

Vulnerability Details

  • PuppyRaffle contract doesn't accept ether but can be forcefully sent to cause DOS on require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");

  • The balance can be modified, but totalFees doesn't.

Impact

  • Severity : high

  • likelihood : medium

Tools Used

  • manual verification

Recommendations

  • add the below fallback function

fallback() external payable {
totalFees += msg.value;
}
Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

greifers-send-money-to-contract-to-block-withdrawfees

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.