Submission Details
Impact:
Likelihood:
✅ `PuppyRaffle::getActivePlayerIndex` returns 0 for non-existing players and for players at index 0, causing a player at index 0 to incorrectly think they have not entered the raffle
Root + Impact: PuppyRaffle::getActivePlayerIndex returns 0 for non-existing players and for players at index 0, causing a player at index 0 to incorrectly think they have not entered the raffle
Description
If a player is in the `puppyRaffle::players` array at index 0, this will return 0, but according to the natspec, it will also return 0 if the player is not in the array
```javascript
function getActivePlayerIndex(address player) external view returns (uint256) {
for (uint256 i = 0; i < players.length; i++) {
if (players[i] == player) {
return i;
}
}
return 0;
}
```
Risk
Likelihood:
-
When no active player in the raffle
-
getActivePlayerIndex()returns 0 when called -
Owner or users may think there is an active user in the index 0 of the array, indicating just 1 active user. when there is no none
Impact:
A player at index 0 may incorrectly think they have not entered the raffle, and attempt to enter the raffle again, wasting gas.
Proof of Concept
1. User enters the raffle, they are the first entrant
2. `PuppyRaffle::getActivePlayerIndex` returns 0
3. User thinks they have not entered correctly due to the function documentation
**Proof of Code**
<details>
<summary>PoC</summary>
Place the following test into `PuppyRaffleTest.t.sol`.
```javascript
function test_getActivePlayerIndexReturnsZeroForActivePlayers() public {
address[] memory players = new address[](2);
players[0] = playerOne;
players[1] = playerTwo;
puppyRaffle.enterRaffle{value: entranceFee * 2}(players);
uint256 indexOfPlayerOne = puppyRaffle.getActivePlayerIndex(playerOne);
assertEq(indexOfPlayerOne, 0);
}
```
</details>
Recommended Mitigation
The easiest mitigation would be to return if the player us not in the array instead of returning 0.
You could also researve the 0th position for any competition, but a better solution might be to return an `int256` where the function returns -1 if the player is not active
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.