First Flight #2: Puppy Raffle

Summary

The PuppyRaffle contract includes a condition that requires a minimum of four players to participate before the selectWinner function can be executed. However, it is possible for a user to call the refund function after joining the raffle and, if no other players have joined or all participants have refunded, this condition can be bypassed, allowing the selectWinner function to be executed with fewer than four players.

Vulnerability Details

The vulnerability arises from the interaction between the refund function and the condition in the selectWinner function:

1. A user joins the raffle by calling the enterRaffle function.

2. Subsequently, the user calls the refund function to receive a refund of their entrance fee, effectively removing themselves from the list of active players.

3. If no other users have joined the raffle or if all participants have requested refunds and the players array is empty, the condition require(players.length >= 4, "PuppyRaffle: Need at least 4 players") is no longer met.

4. This allows the selectWinner function to be executed with fewer than four players, potentially leading to an unintended situation where the raffle takes place without the minimum required participants.

Impact

• Medium: Bypassing the requirement for a minimum number of players in the selectWinner function can lead to situations where the raffle is conducted with fewer participants than intended, potentially impacting the fairness and expected outcomes of the raffle.

Tools Used

• Manual review of the smart contract code.

Recommendations

To address the vulnerability and ensure that the condition for a minimum number of players is consistently met, consider implementing the following recommendation:

1. Update the refund function to update the players array and reduce its length by one when a user requests a refund. or use mapping instead of array to store players with adding a counter to keep track of the number of players. the counter will be incremented when a new player joins and decremented when a player refunds.

By implementing this recommendation, the contract can maintain the intended minimum participation requirement for the selectWinner function, enhancing the fairness of the raffle.