Beginner FriendlyFoundryNFT
100 EXP
View results
Submission Details
Severity: low
Invalid

Returning Total Supply Instead of Request ID in `snek_raffle::request_raffle_winner` May Cause confusion

[L-1] Returning Total Supply Instead of Request ID in snek_raffle::request_raffle_winner May Cause confusion

Description:
The request_raffle_winner function is designed to request a random winner from the VRF Coordinator after a raffle has completed. However, instead of returning the request_id obtained from the VRF Coordinator, the function returns the total supply of the ERC721 tokens. This discrepancy could lead to confusion and potential issues in tracking and verifying the request for a random winner.

Impact:
Returning the total supply instead of the request_id could have several implications for the raffle process:
Verification Difficulty: For participants or external observers, verifying the outcome of the raffle becomes more challenging. They would need to rely on the total supply of tokens to infer the outcome, which is not a reliable or straightforward method.
Transparency Issues: This approach could lead to transparency issues, as it does not provide a clear and direct way to track the request for a random winner. This could affect the trust and confidence of participants in the raffle process.
Operational Complexity: For the raffle organizers, this could introduce operational complexity. They would need to manage and track the total supply of tokens separately from the actual raffle process, which could increase the administrative overhead.

Proof of Concept:

@external
def request_raffle_winner() -> uint256:
.
.
.
request_id: uint256 = VRF_COORDINATOR.requestRandomWords(
GAS_LANE,
SUBSCRIPTION_ID,
REQUEST_CONFIRMATIONS,
CALLBACK_GAS_LIMIT,
NUM_WORDS
)
@> return ERC721._total_supply()

**Recommended Mitigation:**To address this issue, the function should return the request_id obtained from the VRF Coordinator. This change ensures that the function's return value accurately reflects the outcome of the request for a random winner, making it easier to track and verify the request. Here's an example of how this could be implemented:

@external
def request_raffle_winner() -> uint256:
.
.
.
request_id: uint256 = VRF_COORDINATOR.requestRandomWords(
GAS_LANE,
SUBSCRIPTION_ID,
REQUEST_CONFIRMATIONS,
CALLBACK_GAS_LIMIT,
NUM_WORDS
)
- return ERC721._total_supply()
+ return request_id
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Returning Total Supply Instead of Request ID in request_raffle_winner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.