First Flight #2: Puppy Raffle

Summary

There is a vulnerability in the function getActivePlayerIndex(address player). This vulnerability stems from an incorrect return value when a player is not found in the players array.

Vulnerability Details

The vulnerability can be found at the last line in the following code snippet:

When the specified player is not found in the players array, the function returns a value of 0. This implies that the player is located at the first position of the array, potentially leading to undesired behavior and unintended consequences.

Impact

The impact of this vulnerability is significant, as any contract or people utilizing this function may encounter issues. Contracts or people relying on this function to determine the index of a player and perform actions based on that index, such as refunds, will experience transaction reverting.

Tools Used

Manual review.

Recommendations

To address this vulnerability, I recommend updating the code to revert when the specified player is not found in the players array.