Submission Details
Severity:
Previous winner is set before sending funds
Summary
Previous winner variable previousWinner is set before making sure that the funds are correctly sent.
Vulnerability Details
This vulnerability can lead to reward manipulation.
Impact
Funds might be incorrectly sent or not sent at all.
Tools Used
Manual code analysis.
Recommendations
+ (bool success,) = winner.call{value: prizePool}("");
+ require(success, "PuppyRaffle: Failed to send prize pool to winner");
previousWinner = winner;
- (bool success,) = winner.call{value: prizePool}("");
- require(success, "PuppyRaffle: Failed to send prize pool to winner");
_safeMint(winner, tokenId);
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.