Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Submission Details
Severity: medium
Valid

Looping through players arrays to check for duplicates in `PuppyRaffle::enterRaffle` is a potential Denial of Service (DoS) attack, incrementing gas costs for future entrants

0xsmith__

Looping through players arrays to check for duplicates in `PuppyRaffle::enterRaffle` is a potential Denial of Service (DoS) attack, incrementing gas costs for future entrants

Description


  • ​

  • The`PuppyRaffle::enterRaffle` function loops through the `players` array to check for duplicates. However, the longer the `PuppyRaffle::players`array is, the more checks a new player will have to make. This means the gas costs for players who enter right when the raffle stats will be ramatically lower than those who enter later. Every additional address in the `players` array, is an additional check the loop will have to make.

    ​
// @audits DoS attack
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood: High

  • Reason 1

    * The gas costs for raffle entrants will greatly increase as more players enters the raffle.
    ​
    * Reason 2 : Discouraging later users from entering, and causing a rush at the start of a raffle to be one of the first entrants in the queue.
    ​

Impact:

  • Impact 1 :

    ​

  • an attacker might make the `puppyRaffle::entrants` array so big, that no one else enter, guaranteeing themseselves the win.

Proof of Concept

function test__DenialofService() public {
vm.txGasPrice(1);
​
uint256 NumOfPlayer = 100;
address[] memory players = new address[](NumOfPlayer);
for (uint256 i = 0; i < NumOfPlayer; i++) {
players[i] = address(i);
}
//check how much gas it costs
uint256 gasStart = gasleft();
puppyRaffle.enterRaffle{value: (entranceFee * players.length)}(players);
uint256 gasEnd = gasleft();
​
uint256 gasUsed = (gasStart - gasEnd) * tx.gasprice;
​
console.log("Gas used for 100 players to enter raffle: ", gasUsed);
​
//now for 2nd players
address[] memory playersTwo = new address[](NumOfPlayer);
for (uint256 i = 0; i < NumOfPlayer; i++) {
playersTwo[i] = address(i + NumOfPlayer);
}
//check how much gas it costs
uint256 gasStartSecond = gasleft();
puppyRaffle.enterRaffle{value: (entranceFee * playersTwo.length)}(playersTwo);
uint256 gasEndSecond = gasleft();
​
uint256 gasUsedSecond = (gasStartSecond - gasEndSecond) * tx.gasprice;
​
console.log("Gas used for the 2nd 100 players to enter raffle: ", gasUsedSecond);
assert(gasUsed < gasUsedSecond);
}
​
The `PuppyRaffle::enterRaffle` function performs a duplicate check by looping through
the existing `players` array for every new entrant. As the array grows, each new
entrant must be checked against more addresses, making gas cost a function of
array size rather than a constant.
​
**Test:** Two batches of 100 unique players each enter the raffle sequentially.
​
1. First 100 players enter — `players` array starts empty.
2. Second 100 (different) players enter — `players` array now already holds the first 100.
​
**Result:** Gas cost for the second batch is measurably higher than the first,
despite both batches being identical in size. This confirms gas cost scales with
the number of existing entrants, not just the number of new ones — an unbounded,
attacker-triggerable cost growth (O(n²) behavior).
​
**Impact:** Later entrants pay significantly more gas than early entrants for the
identical action of entering the raffle, and in extreme cases the cost could exceed
block gas limits, blocking new entries entirely.
​

Recommended Mitigation

​
+ mapping(address => uint256) public addressToRaffleId;
+ uint256 raffleId = 0;
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
players.push(newPlayers[i]);
+ addressToRaffleId[newPlayers[i]] = raffleId
}
​
- // Check for duplicates
+ //Check for duplicate only from the new players
+ for (uint256 i = 0; i < newplayers.length; i++) {
require(addressToRaffleId[newPlayers[i]] != raffleId, "PuppyRaffle :: duplicate player");
}
- for (uint256 i = 0; i < players.length - 1; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j], "PuppyRaffle: Duplicate player");
- }
- }
​
emit RaffleEnter(newPlayers);
​
function selectWinner() external {
+ raffleId = raffleId + 1 ;
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!