Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

[H-01] Didn't check the related between msg.sender and the player that be call as a parameter.

gg483704512

Root + Impact

Description

The contract didn't check the relation between `msg.sender` and the `playerIndex` that be call as a parameter,witch make everyone can call `refund` with other people `playerIndex` and stole the `entrancFee` of the `playerIndex`.
// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

​

Recommended Mitigation

Consider adding a map that save the related the `manager` and the `palyer` who played the raffle.And check `msg.sender` if it is the `manager`.
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!