First Flight #2: Puppy Raffle

Summary

enterRaffle is vulnerable to DoS attack

Vulnerability Details

enterRaffle checks for duplicate player address on every call, it is possible that over the period of raffleDuration the global players array might grow to a length where the gas cost to traverse the array to check for duplicate player address might exceed the allowed block gas limit and hence always revert.

This would mean that no other address will be allowed to enter the raffle henceforth.

Impact

DoS attack not allowing players to enter the raffle.

Tools Used

Manual

Recommendations

Use mapping instead of array, or use Openzeppelin EnumerableSet.