First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

The use of strict operator can cause lose of funds

0xsagetony

Summary

In the "withdrawFees" function, the use of a strict equality operator (==) presents a critical vulnerability. This condition checks if "address(this).balance" is equal to "totalFees," which may not hold if additional wei or ether is sent to the contract. As a result, funds intended for withdrawal to "feeAddress" cannot be accessed.

Vulnerability Details

The function withdrawFees has a strict operation of ==, which can lead to a high vulnerability.

POC

Contract

function destroy(address \\_puppyContract) external {
selfdestruct(payable(\\_puppyContract));
}
​

This is a snippet from the above contract AttactPuppyRaffle

Test

function test_withdraw_attack() external {
// function that select winner
testSelectWinner();
​
// The attack
attackRaffle = new AttackRaffle(address(puppyRaffle));
vm.deal(address(attackRaffle), 1 wei);
vm.startPrank(address(attackRaffle));
attackRaffle.destroy(address(puppyRaffle));
​
puppyRaffle.withdrawFees();
vm.stopPrank();
}
​

NOTE All the test functions can be added to the PuppyRaffleTest file because testSelectWinner() and testCanEnterRaffleMany() are functions from the file.

Impact

This vulnerability can have severe consequences, as it prevents the withdrawal of fees to the designated address. Any added wei or ether will disrupt the equality check, potentially locking funds within the contract and impeding normal operations.

Tools Used

Manual

Recommendations

To address this issue, consider using a safe method to compare balances or validate total fees to ensure proper fund withdrawal.

Updates

Lead Judging Commences

Hamiltonite Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

greifers-send-money-to-contract-to-block-withdrawfees

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.