Submission Details
Severity:
No validation for empty array in enterRaffle
Summary
Users can call enterRaffle with an empty array as argument.
Vulnerability Details
One can call enterRaffle with an empty array. The require condition looking at the msg.value is met in this case since no entrance fee needs to be paid. An event is emitted.
Impact
This does not impact the protocol directly. The only consequence it that the calling user will use on transaction fees on a transaction that did not change any state.
Tools Used
Manual review
Recommendations
Add a require the verifies that the argument has a length of at least 1.
Example
require(newPlayers.length > 0, "PuppyRaffle: Need a minimum of 1 address to enter raffle");
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.