Submission Details
Severity:
`snek_raffle.vy::fulfillRandomWords` function uses not safe `send`
Summary
snek_raffle.vy::fulfillRandomWords function uses not safe send may be the cause of a DDoS attack
Vulnerability Details
An attacker can participate from non-payable contract many times (given the absence of checking whether the address is included in the raffle) as a result revert send(recent_winner, self.balance) in snek_raffle.vy::fulfillRandomWords
Impact
Denial of service attack due to reverts of the send command in snek_raffle.vy::fulfillRandomWords
Tools Used
Manual check
Recommendations
We can use safeSend instead of send
+event SendFailed:
+ player: indexed(address)
update snek_raffle.vy::fulfillRandomWords
-send(recent_winner, self.balance)
+success: bool = self.safeSend(recent_winner, self.balance)
+ if not success:
+ log SendFailed(recent_winner)
Rewards breakdown
nSLOC
136This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.