First Flight #2: Puppy Raffle

Summary

Potential DOS attack if invalid address is inputted in enterRaffle() function.

Vulnerability Details

Lack of input validation in the enterRaffle() function could potentially lead to a Denial of Service (DoS) attack.

Impact

An attacker could potentially send an array of invalid addresses to the enterRaffle() function, causing the function to consume all the gas available and prevent other users from interacting with the contract.
This is because the function iterates over the newPlayers array and checks if each address is valid. If an invalid address is encountered, the function will throw an error and consume all the gas available.

Tools Used

Foundry, Remix, PhindAI

Recommendations

In the enterRaffle() function, the contract should check if each address in the newPlayers array is a valid Ethereum address before processing it.
This can be done by using the require statement with the condition:

This check ensures that the function does not proceed if any of the addresses provided are invalid.
And below I have written how it can be implemented in the enterRaffle() function:

This will prevent unexpected behaviour and unexpected attacks.