Wrong accounting of `totalAmountCollected`
Summary
Wrong accounting of totalAmountCollected in selectWinner().
Vulnerability Details
players.length value will not accurately reflect the number of active players if some have called the refund() function. This can lead to incorrect accounting for the totalAmountCollected.
totalAmountCollected = players.length * entranceFee
After some players call refund(), the players.length will not decrease.
Impact
The winner will get more prizes when players get refunded.
Tools Used
Manual review.
Recommendations
Record the active player amount.
Lead Judging Commences
refund-doesnt-reduce-players-array-size-causing-protocol-to-freeze
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.