First Flight #2: Puppy Raffle

Summary

The method getActivePlayerIndex returns the index for a specified address. If the address is not found, it will default to returning 0.

Vulnerability Details

Because lists start counting from 0, the first address to enter the raffle will be at index 0 of the players list. This means that when this address is given to the getActivePlayerIndex method, it will return 0. However, this method will also return 0 for all addresses not found in the list of player addresses. This could lead to unexpected behaviour when the method is expected to return 0 for only the first address in the list, or for only addresses not in the list.

Impact

Unpredictable behaviour from the getActivePlayerIndex method.

Tools Used

Solidity

Recommendations

Set the contract to revert when an address is not found in the list of players instead of returning 0 (a valid index).