First Flight #2: Puppy Raffle

Summary

The selectWinner function within the smart contract calculates the totalAmountCollected by multiplying the players.length by entranceFee. However, this calculation is prone to an integer overflow vulnerability, which may lead to an incorrect computation of totalAmountCollected, affecting the subsequent distribution of funds and NFTs.

Vulnerability Details

The vulnerability occurs at the line:

If the product of players.length and entranceFee exceeds the maximum value of a uint256, an overflow will occur, wrapping the result around and returning a much smaller number than expected.

Impact

An integer overflow in the totalAmountCollected calculation could lead to an unexpected behavior where the total amount of funds collected is misrepresented. This misrepresentation can further impact the distribution of funds to the winner and the feeAddress, and the minting and assignment of NFTs. This compromises the integrity of the raffle and may result in financial loss or unfair advantage to some participants.

POC

In this proof of concept, the test_Overflow function demonstrates how an overflow can occur when the players.length and entranceFee are multiplied together. By incrementing the playersLength to a value that will cause an overflow, the test asserts that an overflow occurred by checking if totalAmountCollected is less than either playersLength or entranceFee.

Tools Used

• Manual review

• Foundry

Recommendations

1. Implement checks to ensure that the product of players.length and entranceFee does not exceed the maximum uint256 value before performing the multiplication.

2. Consider utilizing SafeMath or other similar libraries that provide safe arithmetic operations to prevent overflows.

3. Restrict the maximum number of players or the value of entranceFee to prevent the multiplication from exceeding the maximum uint256 value.

4. Use solidity version ^0.8.0 as it includes overflow/underflow checks