First Flight #2: Puppy Raffle

Summary

Inside the enterRaffle function, the first for-loop (that adds new players to the players array) is not making sure that no Zero address are included in the players array. This way even though the zero address can be added to the players array, it will cause issue later when refunding to that address.

Vulnerability Details

If any of the newPlayers addresses is the zero address, it could potentially cause issues. This is because the zero address is not a valid Ethereum address that can receive Ether or interact with contracts.

For example, if a user tries to enter the raffle with the zero address, they would be added to the players array. However, they would never be able to refund their entrance fee (if they were allowed to), because the zero address cannot receive Ether.

Moreover, the getActivePlayerIndex function:

If a user tries to get the index of the zero address, the function would return 0, which could be misleading because 0 is also a valid index in the players array.

Therefore, it's a good practice to validate the input addresses and ensure they are not the zero address before processing them. This can prevent potential issues and errors in your contract.

Impact

Bad user experience and potential loss of funds.

Tools Used

Recommendations

To address the potential vulnerability of accepting the zero address as a valid player, you can add a check in the enterRaffle function to ensure that none of the input addresses is the zero address.
This can simply be done inside the for-loop that adds newPlayers to the players array.

This modification will cause the function to revert if any of the input addresses is the zero address, preventing it from being added to the players array. This can help prevent potential issues and errors in your contract.