First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

DOS attack can happen while checking for duplicates in the enterRaffle function

pratred

Summary

Checking for duplicates in the enterRaffle function can cause a dos attack.

Vulnerability Details

for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

Due to the nested for loops used inside the enterRaffle function a attacker can enter a large amount of his addressess in the raffle at the start of the raffle causing the players array length to increase in a large amount which would lead to high gas price for the users entering the raffle after the attacker has entered. Due to the high gas price other users won't be able to enter the raffle causing a dos.

Impact

Other players won't be able to enter the raffle due to high gas price.

Poc

function testGasCost() public {
vm.txGasPrice(1);
​
uint256 playersNum = 100;
address[] memory players = new address[](playersNum);
​
// Enter 100 players
for (uint i = 0; i < playersNum; i++) {
players[i] = address(i);
}
​
uint256 gasStart = gasleft();
puppyRaffle.enterRaffle{value:entranceFee * playersNum}(players);
uint256 gasEnd = gasleft();
uint256 gasUsedFirst = (gasStart - gasEnd) * tx.gasprice;
console.log("Gas cost for 1st 100 players : " , gasUsedFirst);
​
//Enter 100 more players
for (uint i = 0; i < playersNum; i++) {
players[i] = address(i+playersNum);
}
​
gasStart = gasleft();
puppyRaffle.enterRaffle{value:entranceFee * playersNum}(players);
gasEnd = gasleft();
uint256 gasUsedSecond = (gasStart - gasEnd) * tx.gasprice;
console.log("Gas cost for 2nd 100 players : " , gasUsedSecond);
​
assert(gasUsedFirst<gasUsedSecond);
​
}

Tools Used

Vs Code

Recommendations

Use mapping for checking for duplicates.

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

denial-of-service-in-enter-raffle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!