First Flight #2: Puppy Raffle

Summary

Potential GAS DoS risk due to storage variable being used inside nested loop.

Vulnerability Details

3 affected functions that could be DoS'ed if the array length is large enough, which may not be that large:

enterRaffle(), getActivePlayerIndex(), _isActivePlayer().

Nested for loop accessing a storage variable during each loop, this could relatively easily lead to high gas costs at best or DoS of function due to gas limit reached revert:

enterRaffle():

Lower risk of gas limit reached induced DoS here, but same recommendations apply:

getActivePlayerIndex();

_isActivePlayer():

Impact

3 affected functions that could be DoS'ed if the array length is large enough, which may not be that large:

enterRaffle(), getActivePlayerIndex(), _isActivePlayer().

Worst case scenario is a bunch of friends wont be able to join the raffle if the friend group is too large.

Tools Used

VSC.

Recommendations

Cache the players.length into a memory variable:

uint256 playersLength = players.length;

And then use the cached variable in the for loops: