Possible infinite loop vulnerability with players storage array
Summary
Refund function should delete a user record instead of setting it to the zero address.This creates gaps in the storage and might cause getActivePlayerIndex to run out of gas.
Vulnerability Details
Refund function replaces the caller's address with the zero address.This creates gaps in the storage and might cause getActivePlayerIndex to run out of gas.
Impact
Users calling getActivePlayerIndex to run out of gas and therefore be unable to withdraw.
Tools Used
Manual review.
Recommendations
Swap the last item in the array with the current item and call pop() on the array.
Lead Judging Commences
refund-doesnt-reduce-players-array-size-causing-protocol-to-freeze
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.