First Flight #11: Snek-Raffle

Summary

• If a player submits a smart contract without implementing the receive() or fallback() function, the attempt to send funds to the winner will fail which will prevent the winner from receiving the funds.

Vulnerability Details

• Here in the pointed line, the contract is trying to send funds(pushing the funds) to the winner. If the winner is a smart contract without a receive() or fallback() function, the attempt to send funds to the winner will fail which will prevent the winner from receiving the funds.

Impact

• The winner will not receive the funds.

• If Maximum players are smart contracts without a receive() or fallback() function, the funds will be locked in the contract and no one will be able to play the game again

Tools Used

• manual review

Recommendations

• we can change the nature of protocol to prevent this issue, by converting smart contract to pull model instead of push model by making the winner to claim the funds instead of sending the funds to the winner.

• we can also add a check in enter_raffle function to check if the player is a smart contract or not, if it is a smart contract then we can prevent the player from entering the raffle.