Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Submission Details
Severity: medium
Valid

Unbounded Player Array Causes Denial of Service in enterRaffle and selectWinner

kudaliar

Unbounded Player Array Causes Denial of Service in enterRaffle and selectWinner

Description

  • Under normal operation, users can enter the raffle by calling enterRaffle, and once the raffle period ends, the owner can call selectWinner to choose a winner and distribute rewards.

  • The contract stores all participants in a dynamically growing players array and performs linear iteration over this array in multiple core functions. As the array grows, gas usage increases proportionally, eventually making these functions exceed the block gas limit and become uncallable, permanently blocking the raffle.

// Root cause in the codebase with @> marks to highlight the relevant section
​
function enterRaffle() external payable {
require(msg.value == entranceFee, "PuppyRaffle: Must send exact ETH");
require(getActivePlayerIndex(msg.sender) == -1, "PuppyRaffle: Duplicate player");
​
// @> Unbounded dynamic array growth
players.push(msg.sender);
}
​
function getActivePlayerIndex(address player) public view returns (int256) {
for (uint256 i = 0; i < players.length; i++) {
// @> Linear scan over entire players array
if (players[i] == player) {
return int256(i);
}
}
return -1;
}
​
function selectWinner() external onlyOwner {
require(block.timestamp >= raffleEndTime, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Not enough players");
​
// @> Function logic depends on iterating and clearing the players array
// Gas cost grows with players.length
}

Risk

Likelihood:

  • A large number of participants join the raffle over time, causing the players array to grow continuously.

  • Core functions (enterRaffle, selectWinner) are called after the array has grown sufficiently large to exceed practical gas limits.

Impact:

  • New users are unable to enter the raffle due to excessive gas consumption.

  • The raffle owner becomes unable to call selectWinner, permanently locking funds and preventing raffle completion.

Proof of Concept

The PoC demonstrates that players.length can grow without bound.

  • Gas costs increase linearly due to repeated array iteration.

  • Once the gas limit is exceeded, the raffle becomes unusable without requiring malicious behavior

function test_DoSByLargePlayerArray() public {
// Simulate many unique participants entering the raffle
for (uint256 i = 0; i < 1_000; i++) {
address player = address(uint160(i + 1));
vm.deal(player, 1 ether);
vm.prank(player);
puppyRaffle.enterRaffle{value: entranceFee}();
}
​
// At sufficient scale, enterRaffle and selectWinner
// will consume excessive gas and revert in real conditions
}

Recommended Mitigation

Replacing linear duplicate checks with a mapping removes the need to iterate over the entire players array.

  • Membership checks become O(1) instead of O(n), preventing gas usage from scaling with participant count.

  • This ensures enterRaffle remains callable regardless of the number of players.

  • Resetting the mapping during raffle completion prevents stale state and preserves correctness.

- address[] public players;
+ mapping(address => bool) public isPlayer;
+ address[] public players;
​
function enterRaffle() external payable {
require(msg.value == entranceFee, "PuppyRaffle: Must send exact ETH");
- require(getActivePlayerIndex(msg.sender) == -1, "PuppyRaffle: Duplicate player");
+ require(!isPlayer[msg.sender], "PuppyRaffle: Duplicate player");
​
+ isPlayer[msg.sender] = true;
players.push(msg.sender);
}
​
+ // Clear isPlayer mapping when raffle resets
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!