First Flight #2: Puppy Raffle

Summary

Potential vulnerable to readonly-reentrancy function (if read in other function) PuppyRaffle.getActivePlayerIndex(address) (src/PuppyRaffle.sol#110-117)

Vulnerability Details

Location:
State variables read that were written after the external call(s):

• PuppyRaffle.players (src/PuppyRaffle.sol#23) was read at END_LOOP (src/PuppyRaffle.sol#111-115)
  This variable was written at (after external call):

• players[playerIndex] = address(0) (src/PuppyRaffle.sol#103)

• PuppyRaffle.players (src/PuppyRaffle.sol#23) was read at i < players.length (src/PuppyRaffle.sol#111)
  This variable was written at (after external call):

• players[playerIndex] = address(0) (src/PuppyRaffle.sol#103)

• PuppyRaffle.players (src/PuppyRaffle.sol#23) was read at players[i] == player (src/PuppyRaffle.sol#112)
  This variable was written at (after external call):

• players[playerIndex] = address(0) (src/PuppyRaffle.sol#103)

• PuppyRaffle.players (src/PuppyRaffle.sol#23) was read at i (src/PuppyRaffle.sol#113)
  This variable was written at (after external call):

• players[playerIndex] = address(0) (src/PuppyRaffle.sol#103)

• PuppyRaffle.players (src/PuppyRaffle.sol#23) was read at END_IF (src/PuppyRaffle.sol#112-114)
  This variable was written at (after external call):

• players[playerIndex] = address(0) (src/PuppyRaffle.sol#103)

• PuppyRaffle.players (src/PuppyRaffle.sol#23) was read at i ++ (src/PuppyRaffle.sol#111)
  This variable was written at (after external call):

• players[playerIndex] = address(0) (src/PuppyRaffle.sol#103)

• PuppyRaffle.players (src/PuppyRaffle.sol#23) was read at 0 (src/PuppyRaffle.sol#116)
  This variable was written at (after external call):

• players[playerIndex] = address(0) (src/PuppyRaffle.sol#103)

Impact

Prone to reentrancy attack

Tools Used

Audit Wizard (Slither)

Recommendations

Check original reentrancy