Faliure to select winner cause by lack of input sensitization
Summary
There are no input checks on calls to PuppyRaffle:enterRaffle so users can enter the raffle with a zero address or smart contract address.
If the smart contract address used to enter the raffle is not able to receive ETH or erc721 PuppyRaffle:selectWinner will fail.
Zero address can cause the same problems.
Vulnerability Details
Impact
it defeats the purpose of the raffle if the winner can't be selected.
Tools Used
Solidity
Recommendations
Add some checks to PuppyRaffle:enterRaffle like:
require(newPlayers[i] != address(0));
require(msg.sender == tx.origin); for smart contracts but keep in mind this one will need revisiting when account abstraction is implemented.
Lead Judging Commences
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.