Submission Details
Severity:
`withdrawFees()` revert, fees permanently stuck in contract.
Summary
Malicious actor can send ETH to the contract to break withdrawFees() even when there is no receive() implemented.
Vulnerability Details
File: PuppyRaffle.sol
158: require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
This line in withdrawFees() will always revert if the check is not equal.
Attacker can send 1wei to this contract using selfdestruct() from malicious contract and invalidate this check.
Impact
withdrawFees() will always revert can causes the fees to be stuck in contract.
Tools Used
Manual Reviews
Recommendations
Since the players array is deleted after winner is selected in selectWinner(), it is recommended to check for active players using players array.
require(players.length == 0, "PuppyRaffle: There are currently players active!");
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
greifers-send-money-to-contract-to-block-withdrawfees
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.