First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

address(0) can be entered into the raffle - resulting in it potentially winning

coffee

Summary

The 'PuppyRaffle::enterRaffle' function has no checks if the address being entered into the raffle is the zero address(0). This can result in the address(0) winning the raffle

Vulnerability Details

Because there are no verifications or checks of the specific addresses being entered into the raffle, the zero address(0) can be entered. With address(0) in the players list, it could potentially win the raffle once selectWinner is called.

The address(0) would not be able to be entered through the enterRaffle function if another player has already refunded from the raffle. This is because it would be considered a duplicate address.

function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
@> players.push(newPlayers[i]);
}

Impact

This test returns as true. Proving that the zero address could be entered into the raffle through the enterRaffle function. This could result in the zero address winning the raffle.

function testAddressZeroCanEnterRaffle() public {
address[] memory players = new address[](1);
players[0] = playerZero;
puppyRaffle.enterRaffle{value: entranceFee}(players);
​
uint256 indexOfPlayerZero = puppyRaffle.getActivePlayerIndex(playerZero);
​
assertEq(puppyRaffle.players(0), playerZero);
}

[PASS] testAddressZeroCanEnterRaffle() (gas: 46758)

Tools Used

-Foundry

Recommendations

It would be suggested in the enterRaffle function to check if address(0) is being entered into the raffle. If it is, then revert with a custom error.

+ error PuppyRaffle__AddressZeroCannotEnterRaffle();
​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
+ if(newPlayers[i] == address(0)) {
+ revert PuppyRaffle__AddressZeroCannotEnterRaffle();
+ }
players.push(newPlayers[i]);
}
​
// Check for duplicates
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}
emit RaffleEnter(newPlayers);
}
Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

zero address can win the raffle

Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!