First Flight #2: Puppy Raffle

The Solidity version used in PuppyRaffle is 0.7.6. Any versions before 0.8.0 do not have SafeMath enabled by default meaning that calculations are subject to under and overflow. The potential for overflow exists when calculating fee due to not using SafeMath.

Vulnerability Details

In PuppyRaffle:selectWinner, fee is determined using the following calculation:

As the Solidity version is < 0.8.0, SafeMath is not enabled by default and therefore calculations are subject to under and overflow.

The maximum value of a uint256 is 2^256 - 1, therefore if totalAmountCollected * 20 surpasses this maximum value an overflow will occur. The threshold maximum value of totalAmountCollected is 5789604.46 ETH after which fee will overflow.

Impact

If totalAmountCollected surpasses 5789604.46 ETH when calculating fee, an overflow will occur. It is unlikely that this value will be reached but if the entranceFee is large or there is a very high number of players it is possible that an overflow will occur.

Firstly, due to an overflow in the fee, the prize received by the winner will be much smaller than the true prize.

Secondly, if this happens, the value in the contract will be non-zero even if the winner is paid and the feeRecipient withdraws the totalFees. This will result in a state of DoS when calling withdrawFees as explained in the following issue: Unable to withdraw fees if contract balance is non zero when no players are active.

Since the values required to cause overflow would require a large number of players or a high entranceFee, this is a medium risk vulnerability.

Recommended Mitigation

Use OpenZeppelin's SafeMath when performing calculations. When using a Solidity < 0.8.0 SafeMath is not enabled by default and so will need to be added manually. Alternatively, upgrade the Solidity version to >= 0.8.0 to enable SafeMath by default. This means that if an overflow occurs, the function will revert. This will need to be handled correctly to avoid a state of DoS when calling selectWinner()

Tools Used

• Forge