First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

DoS of function `withdrawFees(...)` possible.

remedcu

Summary

As the exact balance of ETH in the contract is used in the function refund(...), there can be DoS situation through vulnerability or exploit.

Vulnerability Details

  • While dividing the winner prizePool and fee, there could be scenarios when 1 wei is lost during division, which will result in the require check of balance and totalFees to not match ever.

  • Even if there is no case of 1 wei lost, any attacker can send 1 wei or more to the contract and make the owner to not use the function refund(...).

Impact

  • DoS on fee withdrawal.

Tools Used

Manual Review

Recommendations

Using the value from totalFees to withdraw (after ensuring the calculation has been corrected mentioned in the previous issue) the fees for owner.

Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

greifers-send-money-to-contract-to-block-withdrawfees

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.