First Flight #2: Puppy Raffle

Summary

If the player address does not exist in the players array, function returns wrong index.

Vulnerability Details

In getActivePlayerIndex function if the player address is not in the players array. Normally it should not return any indexes. However currently function returns the first index.

Impact

The player addresses which are not active will be mixed with the first address in the players array. And first addresses account will be vulnerable

Tools Used

Manual reading.

Recommendations

If the target address is not in the players array, revert an error instead of returning wrong index