Submission Details
Severity:
DOS on withdrawal of fees
Summary
Withdraw fees function can be DOS'd.
Vulnerability Details
Function requires that the balance of the raffle == totalFees. If we send ETH to the contract, this check will always fail, leaving funds stuck in the contract.
An attacker could put the contract into this state by sending a very small amount of ether using self destruct.
Impact
Funds stuck in contract.
Tools Used
Manual review.
Recommendations
Create a function to recover ETH sent to the contract, or that amend function to allow full withdrawal after selectWinner called and before any new players enter.
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
denial-of-service-in-enter-raffle
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.