First Flight #2: Puppy Raffle

Summary

Inefficient duplicate check in enterRaffle() function

Vulnerability Details

In the current implementation, checks are done after addresses are added to the players array.

Impact

This could lead to unnecessary gas costs, as the function iterates over the entire players array for each address in the newPlayers array. If for instance, a user calls the enterRaffle() function and passes an array of 100 addresses, the enterRaffle() function adds each address to the players array and checks for duplicates. This results in the function iterating over the players array 100 times, which is highly inefficient and could consume a lot of gas.
Also, because of CEI (Check Events Interactions) failure, this could lead to possible reentrancy attacks. A function could be created that calls this particular function, and then manipulated for malicious purposes.

Tools Used

Foundry, Remix, PhindAI

Recommendations

Modify the enterRaffle() function to check for duplicates before adding the addresses to the players array. This is done by iterating over the players array for each address in the newPlayers array and checking if the address already exists in the players array. If a duplicate is found, the function emits a RaffleEnter event and does not add the address to the players array. This is more efficient than checking for duplicates after they have been added to the array.