First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy issue exists in refund function

denzi

Summary

Reentrancy bug allows the receiver contract to execute code which can then execute a function inside the puppyRaffle.sol. In this particular issue, The receiver contract can reenter the refund function before it has executed completely. The receiver function can drain more than the allocated funds of the refund.

Vulnerability Details

function refund(uint256 playerIndex) public {
address playerAddress = players[playerIndex];
require(playerAddress == msg.sender,"PuppyRaffle: Only the player can refund");
require(playerAddress != address(0),"PuppyRaffle: Player already refunded, or is not active");
​
payable(msg.sender).sendValue(entranceFee);
​
players[playerIndex] = address(0);
emit RaffleRefunded(playerAddress);
}

In the above code reentrancy issue is present in:

payable(msg.sender).sendValue(entranceFee);
​
players[playerIndex] = address(0);

sendValue transfers control to the receiving address, if its a contract it can execute its fallback function which can contain code that executes the refund function again. This will allow the receiver to reenter the function before their index is set to address(0)

Impact

An attacker can retrieve more than their allocated amount by reentering in to this function. They can drain the contract of its funds and retrieve them on their contract. Loss of funds can occur and if the contract loses too many funds then the selectWinner function will also not execute due to the strict equality not fulfilling.

Tools Used

Manual Review and Slither

Recommendations

Change the code in the following way

players[playerIndex] = address(0);
​
payable(msg.sender).sendValue(entranceFee);

This will first set the index to 0 and then give the control to the receiver. If the receiver tries to reenter then the require will result in a false and not allow further execution.

Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

reentrancy-in-refund

reentrancy in refund() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.