First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Overflow attack possible leading to locked funds

0xbjorn

Summary

There is no overflow guard used in PuppyRaffle::selectWinner() which can lead to an inaccurate pay-out to the winner of the lottery.

Vulnerability Details

The contract uses an old version of Solidity pragma solidity ^0.7.6; which has no built-in over/underflow guard. There is no other form of overflow protection used which makes PuppyRaffle::selectWinner() susceptible to an overflow attack.

function selectWinner() external {
...
uint256 totalAmountCollected = players.length * entranceFee;
uint256 prizePool = (totalAmountCollected * 80) / 100;
uint256 fee = (totalAmountCollected * 20) / 100;
...

If (type(uint256).max / entranceFee) + 1 players enters the raffle the function will overflow.

Impact

Potential over-flow attack which will lead to inaccurate pay-out for the winner.
Is has a high severity but a low probability since the number of players needed to enter are high.

Tools Used

Foundry

Recommendations

Use a newer version (>0.8) of solidity which has built in over-flow guards.

Updates

Lead Judging Commences

Hamiltonite Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

overflow-uint64

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.