Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Unbounded nested loop in enterRaffle() enables permanent denial of service

acat

Root + Impact

Description

  • The enterRaffle() function checks for duplicate players using a nested for loop that compares every player against every other player. This is an O(n²) operation. As the players array grows, the gas cost increases quadratically until it exceeds the block gas limit, making the function impossible to call.

// @> O(n²) — gas cost explodes as players array grows
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

Risk

Likelihood:

  • Any user can generate hundreds of unique addresses cheaply and enter them all

The attacker can later refund to recover their entrance fees, making the attack nearly free

Impact:

  • The enterRaffle() function becomes permanently uncallable once the array is large enough

The entire raffle is bricked — no new participants, no winner selection, no recovery

  • Requires redeploying the contract entirely

Proof of Concept

The attacker creates an array of 1,000 unique addresses and enters them all into the raffle in a single transaction. This is valid — the contract allows entering on behalf of multiple addresses. Now the players array has 1,000+ entries. When the next legitimate user tries to call enterRaffle(), the nested duplicate check must compare every pair of players: roughly 1,000 × 999 / 2 = 499,500 comparisons. Each comparison is a storage read (expensive) plus a comparison operation. The total gas cost exceeds Ethereum's block gas limit (30 million gas), so the transaction is mathematically impossible to execute. The raffle is permanently frozen. The attacker can then call refund() on all their entries to recover their entrance fees, making the attack nearly free.

// Attacker generates 1000 unique addresses and enters them
address[] memory spam = new address[](1000);
for (uint256 i = 0; i < 1000; i++) {
spam[i] = address(uint160(i + 1)); // unique addresses
}
puppyRaffle.enterRaffle{value: entranceFee * 1000}(spam);
​
// Next legitimate user tries to enter:
// Duplicate check now runs ~500,000 comparisons
// Exceeds block gas limit → transaction always reverts
// Raffle is permanently dead

Recommended Mitigation

Replace the nested loop with a mapping(address => bool) for duplicate detection. A mapping lookup is a single hash operation that costs the same amount of gas regardless of how many players exist — O(1) constant time versus O(n²) quadratic time. This completely eliminates the DoS vector because the gas cost of entering the raffle no longer depends on the number of existing players. The mapping entries must be reset when the raffle ends so players can enter future rounds, which requires a single O(n) loop through the players array — acceptable since it runs once per raffle cycle in selectWinner(), not on every entry.

+ mapping(address => bool) public hasEntered;
​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "...");
for (uint256 i = 0; i < newPlayers.length; i++) {
+ require(!hasEntered[newPlayers[i]], "PuppyRaffle: Duplicate player");
+ hasEntered[newPlayers[i]] = true;
players.push(newPlayers[i]);
}
​
- for (uint256 i = 0; i < players.length - 1; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j], "PuppyRaffle: Duplicate player");
- }
- }
emit RaffleEnter(newPlayers);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!