First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

contract not having a re entrancy guard presents vulnerabilities on several functions

Oozman

PoC for reEntrancy Vulnerability

Summary

The PuppyRaffle contract does not have a re entrancy guard.
This presents vulnerabilities on several functions, and particularly the following state altering ones:

PuppyRaffle::enterRaffle()
PuppyRaffle::refund()
PuppyRaffle::selectWinner()

Vulnerability Details

A malicious contract calling one of these three functions might use its fallback function to recursively call PuppyRaffle.sol and either drain its total funds or make it so that it would break its business logic.

Impact

HIGH:

PuppyRaffle::enterRaffle(): a hacker could re enter the function and duplicate an address in order to increase its probability of winning the raffle.

PuppyRaffle::refund(): a hacker could re enter the function and drain all the fees paid by all the raffle's players.

MEDIUM:

PuppyRaffle::selectWinner(): a hacker could re enter the function and make it that there are several winners for the same raffle.

Tools Used

  • VScode

  • Slither

Recommendations

Apply the following modifications to PuppyRaffle.sol:

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;
​
import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol";
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
import {Address} from "@openzeppelin/contracts/utils/Address.sol";
import {Base64} from "lib/base64/base64.sol";
+ import {ReentrancyGuard} from "https://github.com/OpenZeppelin/openzeppelin-contracts/blob/release-v3.4/contracts/utils/ReentrancyGuard.sol"
- contract PuppyRaffle is ERC721, Ownable {
+ contract PuppyRaffle is ERC721, Ownable, ReentrancyGuard {
- function enterRaffle(address[] memory newPlayers) public payable {
+ function enterRaffle(address[] memory newPlayers) public payable nonReentrant {
- function refund(uint256 playerIndex) public {
+ function refund(uint256 playerIndex) public nonReentrant {
- function selectWinner() external {
+ function selectWinner() external nonReentrant {
Updates

Lead Judging Commences

patrickalphac Lead Judge
about 2 years ago
Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

reentrancy-in-refund

reentrancy in refund() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!