Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

[L-01] getActivePlayerIndex() returns 0 for both index-0 player and not-found

sharonkosgei4

Root + Impact

Description

  • The function is intended to return a player's position in players[]. When no match is found it returns 0, which is indistinguishable from a valid match at index 0.

function getActivePlayerIndex(address player) external view returns (uint256) {
for (uint256 i = 0; i < players.length; i++) {
if (players[i] == player) return i;
}
@> return 0; // ambiguous — same as players[0]
}

Risk

Likelihood:

  • Off-chain tooling or a player checking their index receives 0 even when they are not in the raffle

  • A non-participant who trusts the return value attempts refund(0), wasting gas

Impact:

  • Incorrect UX / off-chain index resolution

  • A non-participant's refund(0) call reverts rather than failing gracefully

Proof of Concept

A player not in the raffle calls getActivePlayerIndex(theirAddress), receives 0, then calls refund(0) — the require(players[0] == msg.sender) check reverts, but the caller had no way to distinguish "not found" from "at index 0" using the return value alone.

Recommended Mitigation

- return 0;
+ revert("PuppyRaffle: Player not active");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 5 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!