First Flight #2: Puppy Raffle

Summary

Potential DoS vulnerability in the PuppyRaffle::enterRaffle function

Vulnerability Details

The logic that is inside the enterRaffle() function is checking if a player has already entered the raffle. The problem is that it uses a nested for loop in order to achieve the desired result. Also, the logic that checks if a given player entered the raffle should happen before we add the player to the players array.

Impact

This nested loop can cause a DoS vulnerability. This will happen if a lot of players are passed to the array.

Tools Used

Manual Review

Recommendations

One way to solve this is to create a mapping that keeps track of the players that have entered the raffle.