Summary

The selectWinner function in the smart contract uses the modulo operation with the size of the players array to calculate the winnerIndex. However, if there are zero addresses present in the players array, it is possible for an empty address to be selected as the winner. This can lead to unfair outcomes for active players.

Vulnerability Details

The issue lies in the selectWinner function, the winner select calculation does not consider the presence of empty addresses within the array. Consequently, an empty address can be chosen as the winner, causing active players to be unfairly excluded from winning. To resolve this, the function should create a separate array that only includes non-empty addresses for selecting the winner.

Impact

• Unfair Results: The presence of empty addresses allows the selection of an empty address as the winner, which is unjust for active participants.

• Loss of Trust: Unfair outcomes undermine trust in the smart contract and the integrity of the raffle system.

• Manipulation: Malicious actors may exploit this vulnerability by intentionally adding empty addresses to increase their chances of winning or disrupt the fairness of the raffle.

Tools Used

Manual Review

Recommendations

To address this vulnerability, the selectWinner function should be modified as follows:

1. Create a new array, named activePlayers, to store the non-empty addresses from the players array.

2. Iterate over the players array and populate the activePlayers array with the non-empty addresses.

3. Calculate the winnerIndex using the size of the activePlayers array instead of the players array.

4. Select the winner from the activePlayers array using the calculated winnerIndex.