Submission Details
Severity:
address(0) can be the winner of the raffle
Summary
address(0) can be entered into the raffle, and if selected, funds and NFT will be lost.
Vulnerability Details
Because enterRaffle does not check for address(0) being inputted as a player, there can be a scenario where it is selected as the winner and then funds are lost as well as the NFT.
Impact
High
Tools Used
Foundry
Recommendations
Check that address(0) is not being sent as parat of the newPlayers array in enterRaffle()
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Assigned finding tags:
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.