Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Zeroed winner slot in PuppyRaffle::selectWinner() causes _safeMint(address(0)) revert, permanently stalling the raffle

georgibuilds

Root + Impact

Description

  • When winnerIndex lands on a refunded slot, winner is set to
    address(0). PuppyRaffle::selectWinner() then sends the prize
    to address(0) — burning it permanently — before reverting on
    _safeMint(address(0)) because OpenZeppelin ERC721 rejects
    minting to the zero address. The entire transaction reverts,
    leaving the raffle permanently stalled with no reset possible.

function selectWinner() external {
uint256 winnerIndex = uint256(keccak256(abi.encodePacked(
msg.sender, block.timestamp, block.difficulty
))) % players.length;
​
// @> If slot was zeroed by refund(), winner = address(0)
address winner = players[winnerIndex];
uint256 prizePool = (totalAmountCollected * 80) / 100;
// @> ETH sent to address(0) — burned forever
(bool success,) = winner.call{value: prizePool}("");
require(success, "PuppyRaffle: Failed to send prize pool to winner");
// @> Reverts: ERC721 rejects mint to address(0)
_safeMint(winner, tokenId);
}

Risk

Likelihood:

  • Requires winnerIndex to land on a refunded slot

  • Probability proportional to fraction of zeroed slots

  • Combined with weak randomness bug — attacker can
    deliberately trigger this to permanently stall the raffle

Impact:

  • Requires winnerIndex to land on a refunded slot

  • Probability proportional to fraction of zeroed slots

  • Combined with weak randomness bug — attacker can
    deliberately trigger this to permanently stall the raffle

Proof of Concept

Attack Path:

  1. 10 players enter — contract holds 10 ETH

  2. Attacker predicts winnerIndex using same formula

  3. Attacker is the player at predicted index

  4. Attacker calls refund() — their slot = address(0)

  5. selectWinner() runs:
    winner = players[winnerIndex] = address(0)
    prizePool = 10 ETH * 80% = 8 ETH
    winner.call{value: 8 ETH} → SUCCEEDS
    (8 ETH burned to address(0) forever)
    _safeMint(address(0)) → REVERTS

  6. Transaction reverts — 8 ETH burned, raffle frozen

function test_zeroed_winner() public {
address[] memory players = new address[](10);
players[0] = makeAddr("Alice");
players[1] = makeAddr("Bob");
players[2] = makeAddr("Carol");
players[3] = makeAddr("Dave");
players[4] = makeAddr("Georgi");
players[5] = makeAddr("Katerina");
players[6] = makeAddr("Adrian");
players[7] = makeAddr("Blaga");
players[8] = makeAddr("Antani");
players[9] = makeAddr("Samuil");
​
vm.deal(players[0], entranceFee * 10);
vm.prank(players[0]);
puppyRaffle.enterRaffle{value: entranceFee * 10}(players);
​
vm.warp(block.timestamp + raffleDuration + 1);
​
uint256 predictedWinnerIndex = uint256(
keccak256(abi.encodePacked(
address(this),
block.timestamp,
block.difficulty
))
) % players.length;
​
vm.prank(players[predictedWinnerIndex]);
puppyRaffle.refund(predictedWinnerIndex);
​
console.log("Zeroed slot index:", predictedWinnerIndex);
console.log("Contract balance:", address(puppyRaffle).balance);
​
vm.expectRevert();
puppyRaffle.selectWinner();
}

Recommended Mitigation


Add a zero address check for the winner before sending
the prize and minting the NFT. If winner is address(0),
skip that index and select the next valid player, or
revert with a clear error message to allow a new attempt.

address winner = players[winnerIndex];
+ require(winner != address(0),
+ "PuppyRaffle: Winner slot is empty, try again");
(bool success,) = winner.call{value: prizePool}("");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-04] `PuppyRaffle::refund` replaces an index with address(0) which can cause the function `PuppyRaffle::selectWinner` to always revert

## Description `PuppyRaffle::refund` is supposed to refund a player and remove him from the current players. But instead, it replaces his index value with address(0) which is considered a valid value by solidity. This can cause a lot issues because the players array length is unchanged and address(0) is now considered a player. ## Vulnerability Details ```javascript players[playerIndex] = address(0); @> uint256 totalAmountCollected = players.length * entranceFee; (bool success,) = winner.call{value: prizePool}(""); require(success, "PuppyRaffle: Failed to send prize pool to winner"); _safeMint(winner, tokenId); ``` If a player refunds his position, the function `PuppyRaffle::selectWinner` will always revert. Because more than likely the following call will not work because the `prizePool` is based on a amount calculated by considering that that no player has refunded his position and exit the lottery. And it will try to send more tokens that what the contract has : ```javascript uint256 totalAmountCollected = players.length * entranceFee; uint256 prizePool = (totalAmountCollected * 80) / 100; (bool success,) = winner.call{value: prizePool}(""); require(success, "PuppyRaffle: Failed to send prize pool to winner"); ``` However, even if this calls passes for some reason (maby there are more native tokens that what the players have sent or because of the 80% ...). The call will thankfully still fail because of the following line is minting to the zero address is not allowed. ```javascript _safeMint(winner, tokenId); ``` ## Impact The lottery is stoped, any call to the function `PuppyRaffle::selectWinner`will revert. There is no actual loss of funds for users as they can always refund and get their tokens back. However, the protocol is shut down and will lose all it's customers. A core functionality is exposed. Impact is high ### Proof of concept To execute this test : forge test --mt testWinnerSelectionRevertsAfterExit -vvvv ```javascript function testWinnerSelectionRevertsAfterExit() public playersEntered { vm.warp(block.timestamp + duration + 1); vm.roll(block.number + 1); // There are four winners. Winner is last slot vm.prank(playerFour); puppyRaffle.refund(3); // reverts because out of Funds vm.expectRevert(); puppyRaffle.selectWinner(); vm.deal(address(puppyRaffle), 10 ether); vm.expectRevert("ERC721: mint to the zero address"); puppyRaffle.selectWinner(); } ``` ## Recommendations Delete the player index that has refunded. ```diff - players[playerIndex] = address(0); + players[playerIndex] = players[players.length - 1]; + players.pop() ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!