First Flight #2: Puppy Raffle

Summary

Addresses can enter the raffle multiple times

Vulnerability Details

The function enterRaffle only checks if a duplicate address is found in the function input, but does not check if the address is already present in the storage variable players. This allows a player to enter his address twice by calling the function twice.

Impact

High.

Tools Used

n/a

Recommendations

Use a map (address => bool) which maps which addresses have entered for the raffle. When going through the newPlayers input array, for each address a check if players[a] == true. If so, revert because that address is already in raffle. Else, set players[a] = true. This solves the problem and also allows us to remove the code below, which is no longer necessary: