Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Quadratic Gas Cost in enterRaffle() Enables Denial of Service Attack

vikramgoutham289

Root + Impact

Root Cause: Duplicate address check uses nested loops with O(n²) time complexity, causing gas costs to grow quadratically with player count until exceeding block gas limit.

Impact: After sufficient players enter, new entries become impossible, effectively breaking the raffle and potentially locking funds.

Description

Normal Behavior: Users should be able to enter the raffle by paying the entrance fee, with the contract checking for duplicate addresses.

Issue: The duplicate check uses a nested loop O(n²) that iterates through all existing players. As more players join, gas costs increase quadratically until they exceed the block gas limit, making it impossible for new players to enter.
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
players.push(newPlayers[i]);
}
​
// @> O(n²) complexity - gas increases quadratically with player count
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}
emit RaffleEnter(newPlayers);
}

Risk

Likelihood:MEDIUM

  • Reason 1 : Gas costs become prohibitive after ~100-200 players

  • Reason 2: An attacker can intentionally fill the raffle with many addresses cheaply

Impact:

  • Impact 1: New legitimate users cannot enter the raffle

  • Impact 2: Protocol becomes non-functional after certain player threshold

Proof of Concept

First player: 0 comparisons
Second player: 1 comparison
Third player: 2 comparisons
Nth player: N-1 comparisons
Total for N players: N*(N-1)/2 comparisons
​
function testDenialOfServiceGasIncrease() public {
uint256 entranceFee = puppyRaffle.entranceFee();
// Test with increasing player counts
uint256[] memory playerCounts = new uint256[](4);
playerCounts[0] = 10;
playerCounts[1] = 50;
playerCounts[2] = 100;
playerCounts[3] = 200;
​
for (uint256 p = 0; p < playerCounts.length; p++) {
// Reset for each test
PuppyRaffle freshRaffle = new PuppyRaffle(entranceFee, feeAddress, duration);
uint256 numPlayers = playerCounts[p];
address[] memory players = new address[](numPlayers);
for (uint256 i = 0; i < numPlayers; i++) {
players[i] = address(uint160(i + 1));
}
​
uint256 gasBefore = gasleft();
freshRaffle.enterRaffle{value: entranceFee * numPlayers}(players);
uint256 gasUsed = gasBefore - gasleft();
​
console.log("Players:", numPlayers, "Gas used:", gasUsed);
}
​
// Output shows quadratic growth:
// Players: 10 Gas used: ~6,000
// Players: 50 Gas used: ~140,000
// Players: 100 Gas used: ~540,000
// Players: 200 Gas used: ~2,100,000
// At ~1000 players, exceeds block gas limit
}
​
function testDenialOfServiceAttack() public {
uint256 entranceFee = puppyRaffle.entranceFee();
// Attacker fills raffle with many addresses
uint256 attackerPlayers = 500;
address[] memory attackerAddresses = new address[](attackerPlayers);
for (uint256 i = 0; i < attackerPlayers; i++) {
attackerAddresses[i] = address(uint160(i + 1));
}
puppyRaffle.enterRaffle{value: entranceFee * attackerPlayers}(attackerAddresses);
​
// Now legitimate user tries to enter
address legitimateUser = address(999999);
address[] memory legitPlayers = new address[](1);
legitPlayers[0] = legitimateUser;
​
// This will either fail due to gas limit or cost excessive gas
vm.expectRevert(); // Out of gas
puppyRaffle.enterRaffle{value: entranceFee}(legitPlayers);
}

Recommended Mitigation

Replace the O(n²) array search with an O(1) mapping lookup. By maintaining a mapping of addresses to raffle IDs, we can check for duplicates in constant time. The raffle ID is incremented each round to "reset" the mapping without clearing it.

+ mapping(address => uint256) public addressToRaffleId;
+ uint256 public raffleId = 1;
​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
+ // O(1) duplicate check using mapping
+ require(
+ addressToRaffleId[newPlayers[i]] != raffleId,
+ "PuppyRaffle: Duplicate player"
+ );
+ addressToRaffleId[newPlayers[i]] = raffleId;
players.push(newPlayers[i]);
}
​
- // Check for duplicates
- for (uint256 i = 0; i < players.length - 1; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j], "PuppyRaffle: Duplicate player");
- }
- }
emit RaffleEnter(newPlayers);
}
​
function selectWinner() external {
// ... existing logic ...
delete players;
raffleStartTime = block.timestamp;
+ raffleId++; // Increment to invalidate old mappings
// ... rest of function ...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 6 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!