First Flight #2: Puppy Raffle

Summary

The PuppyRaffle contract allows for a situation in which the prize, sent to the winning address upon calling the selectWinner function, may be inadvertently transferred to the zero address (address(0)). This occurs when a user, who was initially a participant, requests a refund, causing their address in the players array to be set to address(0). If the winner index corresponds to address(0), the prize will be transferred to the zero address with no checks in place to prevent this.

Vulnerability Details

The vulnerability arises from the following interactions within the selectWinner function:

1. Users join the raffle by calling the enterRaffle function, adding their addresses to the players array.

2. Subsequently, a user calls the refund function to receive a refund, which sets their address in the players array to address(0).

3. The selectWinner function selects the winner by choosing a random index from the players array.

4. If the randomly chosen index corresponds to address(0) (zero address), the prize is transferred to this address without any checks in place to prevent it.

Impact

• Medium: The possibility of the prize being transferred to the zero address upon user refund can lead to unintended outcomes in the raffle, potentially causing confusion and dissatisfaction among participants.

Tools Used

• Manual review of the smart contract code.

Recommendations

To mitigate the vulnerability and ensure that the prize is never accidentally transferred to the zero address, consider the following recommendation:

1. In the selectWinner function, add a check to ensure that the randomly selected index from the players array does not correspond to the zero address (address(0)). If the selected index is address(0), regenerate the selection until a valid address is chosen as the winner. This ensures that the prize is always transferred to a valid participant.

By implementing this recommendation, the contract can prevent the prize from being sent to the zero address due to user refunds, maintaining the integrity and fairness of the raffle.