Root + Impact

Description

Risk

Likelihood: Low — only affects the player sitting at index 0.

Impact: Low — that player may believe they are not registered and enter again, wasting the entrance fee. No funds are at risk beyond the wasted gas.

Proof of Concept

No exploit test is needed; the ambiguity is evident from the return value.
A player whose address is stored at players[0] calls getActivePlayerIndex and
receives 0 — identical to the "not found" return — so they cannot tell whether
they are registered. The same 0 is returned in both cases:

• players[0] == player -> returns 0 (valid index)

- player not in array -> returns 0 (not found)

Recommended Mitigation

Revert when the player is not found instead of returning 0, or return a
sentinel that cannot be a valid index (e.g. type(uint256).max). This removes
the ambiguity with the valid index 0.