First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

refund function allows re-entrancy which can result in attacker emptying contract balance

dougo

Summary

refund function allows re-entrancy which can result in attacker emptying contract balance.

Vulnerability Details

The refund function, see relevant lines below, allows for re-entrancy attack due to state-changing code after sending the refund value to entrant.

payable(msg.sender).sendValue(entranceFee);
players[playerIndex] = address(0);
emit RaffleRefunded(playerAddress);

A test showing how to exploit this vulnerability is located here.

The contract, Attack.sol, which was used to request multiple refunds and empty contract is here

An image showing the test's failure is here

Impact

High - likelihood and impact are both high. The protocol could lose all funds held by contract.

Tools Used

VS Code
Hardhat

Recommendations

Rewrite the refund function such that there is no state-changing code following the payment of funds.

players[playerIndex] = address(0);
payable(msg.sender).sendValue(entranceFee);
emit RaffleRefunded(playerAddress);
Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

reentrancy-in-refund

reentrancy in refund() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.