Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Missing access control on `withdrawFees`

mathcelo

The withdrawFees function (L187-196) has no access control modifier. Any address can call it. While the fees are always transferred to feeAddress (not the caller), this surrenders timing control to arbitrary external actors. The owner cannot control when fees are withdrawn.

Exploit Scenario

  1. The owner intends to accumulate fees across multiple raffle rounds before withdrawing.

  2. After each selectWinner call, a bot immediately calls withdrawFees, transferring fees to feeAddress before the owner chooses to.

  3. No funds are lost, but the owner has no control over withdrawal timing.

Proof of Concept

function test_anyoneCanCallWithdrawFees() public {
// 4 players enter (minimum required for selectWinner)
address[] memory players = new address[](4);
players[0] = playerOne;
players[1] = playerTwo;
players[2] = playerThree;
players[3] = playerFour;
puppyRaffle.enterRaffle{value: entranceFee * 4}(players);
​
// Warp past raffle duration so selectWinner can be called
vm.warp(block.timestamp + duration + 1);
puppyRaffle.selectWinner();
​
// totalFees is now the 20% cut from 4 players
uint256 expectedFees = (entranceFee * 4 * 20) / 100;
assertEq(uint256(puppyRaffle.totalFees()), expectedFees);
​
uint256 feeAddressBalanceBefore = feeAddress.balance;
​
// Random non-owner address calls withdrawFees
address attacker = makeAddr("attacker");
vm.prank(attacker);
puppyRaffle.withdrawFees();
​
// Fees went to feeAddress, not the attacker -- but anyone triggered it
assertEq(uint256(puppyRaffle.totalFees()), 0);
assertEq(feeAddress.balance, feeAddressBalanceBefore + expectedFees);
}

Recommendations

Short term: Add the onlyOwner modifier to withdrawFees:

function withdrawFees() external onlyOwner {

Long term: Consider a more flexible access control scheme if multiple roles need withdrawal authority (e.g., OpenZeppelin's AccessControl).

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!