First Flight #2: Puppy Raffle

Summary

Function 'getActivePlayerIndex' does not check for address(0)

Vulnerability Details

Function 'getActivePlayerIndex' does not check for address(0) thus allowing address(0) to be searched for within 'players' array.

Impact

Depending on which addresses previously called 'refund' function (which leaves behind address(0) in the 'player' address), the 'getActivePlayerIndex' function would return different results -> the first occurrence of address(0) in the 'players' array.

Tools Used

Recommendations

Validate the input against address(0)