A non-existent player can be the winner.
Summary
It is possible that the winner-determination algorithm will select the index of a player who has already withdrawn by making a refund. In other words, a zero address may become the winner.
Vulnerability Details
The selectWinner function performs the validation that players.length >= 4. However, the index of the player withdrawn by refund is assigned a zero address, so the withdrawn player is included in this (since the length of the array does not change). Thus, the zero address could be the winner.
Impact
Zero address would be the winner.
Tools Used
Manual
Recommendations
When redund, also reduce the length of the players array
Lead Judging Commences
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.