Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

O(n²) nested loop in PuppyRaffle::enterRaffle() enables permanent gas DoS at ~170 players

georgibuilds

Root + Impact

Description

  • PuppyRaffle::enterRaffle() checks for duplicate players using
    a nested loop that compares every new player against every
    existing player. Gas cost scales as O(n²) — doubling the
    player count quadruples the gas cost. At approximately 170
    cumulative players, the gas required exceeds the 30M block
    gas limit, permanently preventing new entries. Since entrance
    fees are refundable, an attacker can trigger this at minimal
    net cost.

function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length,
"PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
players.push(newPlayers[i]);
}
// @> Nested loop — O(n²) gas cost
// @> Checks ALL players against ALL new players
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j],
"PuppyRaffle: Duplicate player");
}
}
}

Risk

Likelihood:

  • Occurs naturally as player count grows

  • Attacker can accelerate by entering large batches

  • Entrance fees are refundable — net cost is only gas

Impact:

  • enterRaffle() permanently reverts above ~170 players

  • No new players can ever join

  • Protocol becomes permanently unusable

  • Existing players funds remain locked until selectWinner()

Proof of Concept

Attack Path:

  1. Attacker enters 100 players in first batch
    Gas cost: 6,521,745

  2. Attacker enters 100 more players
    Gas cost: 18,996,087 (3x more expensive)

  3. Gas cost grows quadratically with each batch

  4. At ~170 total players: gas > 30M block limit

  5. enterRaffle() permanently reverts

  6. Protocol accepts no new players ever again

  7. Attacker recoups entrance fees via refund()

function test_dos() public {
address[] memory players = new address[](100);
for (uint256 i = 0; i < 100; i++) {
players[i] = address(uint160(i + 1));
}
vm.deal(players[0], entranceFee * 100);
​
uint256 gasBeforeFirst = gasleft();
vm.prank(players[0]);
puppyRaffle.enterRaffle{value: entranceFee * 100}(players);
uint256 gasAfterFirst = gasleft();
uint256 gasFirstBatch = gasBeforeFirst - gasAfterFirst;
console.log("Gas first 100 players:", gasFirstBatch);
​
address[] memory playersSecond = new address[](100);
for (uint256 i = 0; i < 100; i++) {
playersSecond[i] = address(uint160(i + 101));
}
vm.deal(playersSecond[0], entranceFee * 100);
​
uint256 gasBeforeSecond = gasleft();
vm.prank(playersSecond[0]);
puppyRaffle.enterRaffle{value: entranceFee * 100}(playersSecond);
uint256 gasAfterSecond = gasleft();
uint256 gasSecondBatch = gasBeforeSecond - gasAfterSecond;
console.log("Gas second 100 players:", gasSecondBatch);
​
assertGt(gasSecondBatch, gasFirstBatch);
}

Recommended Mitigation

Replace the nested loop with a mapping to track entered
addresses. O(1) lookup eliminates the gas scaling issue
entirely — each new player is checked against the mapping
in constant time regardless of total player count.

+ mapping(address => bool) private _isEntered;
​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length);
for (uint256 i = 0; i < newPlayers.length; i++) {
+ require(!_isEntered[newPlayers[i]],
+ "PuppyRaffle: Duplicate player");
+ _isEntered[newPlayers[i]] = true;
players.push(newPlayers[i]);
}
- for (uint256 i = 0; i < players.length - 1; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j],
- "PuppyRaffle: Duplicate player");
- }
- }
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!