First Flight #2: Puppy Raffle

Summary

The current implementation of the duplicate error check can cause the cost of gas for each subsequent PuppyRaffle::enterRaffle() to increase exponentially. This is considered a Denial of Service attack as it means an attacker can enter a lage quantity addresses, increasing the size of the players array massively in a single transaction, thereby making the gas price for entry prohibitively expensive for any following players.

Vulnerability Details

For loops are significant gas consumers, so the fact that there two for loops over the entire players array, would cause the gas fees to increase exponentially as the players array grows. Normally, gas optimizations are considered differently, however, this is a security vulnerability because it can become a Denial of Service. An attacker can prevent or highly discourage additional players from entering the raffle by increasing the cost of gas to be so expensive as additional players will refuse to pay. This would then give the attacker to have a disproportionate advantage of winning the raffle.

Here is a test case to demonstrate the behavior:

As you can see, after every 100 bulk entries, the gas cost for the next entry is quite large:

Impact

Once the players array has grown large enough, additional players will very likely find the cost of the gas to join prohibitively expensive. This would limit the number of players that would join the raffle and give an attacker a disproportionate advantage of winning the raffle.

Tools Used

Manual Review and Foundry

Recommendations

1. Consider allowing duplicate addresses. Based on the documentation and the logic in the contract there is no clear reason why duplicates should not be allowed. No matter how many times a player wants to enter the raffle, they have to pay the entranceFee. And selecting the winner does not appear to be adversely effected should there be a single address in the array more than once.

2. If there is a legitimate business case to be made that is not clear, then consider using an alternative method for tracking and determining if the address is a duplicate. One method that would be far more efficient might be using a mapping to track address and a flag to indicate the address is already entered.