Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

looping through player array to check for duplicates in `PuppyRaffle::enterRaffle` is potential denial of service(Dos)attack, incrementing gas cost for future entrants

farhandavin14

[M-1] Looping through players array to check for duplicates in PuppyRaffle::enterRaffle causes Denial of Service (DoS) due to unbounded gas consumption

Description

In PuppyRaffle::enterRaffle, the contract checks for duplicate players by using nested for loops that iterate over the entire players array:

for (uint256 i = 0; i < players.length; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

This implementation has an time complexity, where is the total number of players in players.length.

As the number of entrants increases, the gas cost for each subsequent entrant scales quadratically. Eventually, the gas required to execute enterRaffle will exceed the Ethereum block gas limit (30,000,000 gas) or become economically prohibitive for participants, causing the contract to revert on every subsequent entry.

Risk

  • Likelihood: High. Every new batch of entrants increases the size of the array, making this vulnerability guaranteed to manifest as participation grows. Furthermore, a malicious actor can deliberately enter multiple addresses with small fees to quickly inflate the array and grief subsequent participants.

  • Impact: Medium/High. Legitimate users will be unable to join the raffle due to transaction reverts (out-of-gas errors) or unreasonably high gas fees, resulting in a permanent Denial of Service (DoS) for future entries in that raffle round.

Proof of Concept

The following Foundry test demonstrates the quadratic gas cost increase. Entering a second batch of 100 players consumes significantly more gas than the first batch of 100 players due to the nested loop scanning all previous entrants.

Add this test function to test/PuppyRaffleTest.t.sol:

function test_denialOfService_enterRaffleGasExhaustion() public {
vm.txGasPrice(1);
uint256 playersNum = 100;
​
// 1. First batch of 100 players
address[] memory playersFirstBatch = new address[](playersNum);
for (uint256 i = 0; i < playersNum; i++) {
playersFirstBatch[i] = address(uint160(i + 1));
}
​
uint256 gasStartFirst = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * playersNum}(playersFirstBatch);
uint256 gasUsedFirst = (gasStartFirst - gasleft()) * tx.gasprice;
console.log("Gas cost for first 100 players: ", gasUsedFirst);
​
// 2. Second batch of 100 players
address[] memory playersSecondBatch = new address[](playersNum);
for (uint256 i = 0; i < playersNum; i++) {
playersSecondBatch[i] = address(uint160(i + 101));
}
​
uint256 gasStartSecond = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * playersNum}(playersSecondBatch);
uint256 gasUsedSecond = (gasStartSecond - gasleft()) * tx.gasprice;
console.log("Gas cost for second 100 players: ", gasUsedSecond);
​
// Assert that the gas cost for the second batch is dramatically higher
assertGt(gasUsedSecond, gasUsedFirst);
}

How to Run:

Run the test in your terminal using Foundry:

forge test --mt test_denialOfService_enterRaffleGasExhaustion -vv

Output:

The log output will show that the second batch of 100 players costs over 3x more gas than the first batch, proving that gas scales rapidly as the array grows:

[PASS] test_denialOfService_enterRaffleGasExhaustion() (gas: ...)
Logs:
Gas cost for first 100 players: 6252048
Gas cost for second 100 players: 18068143

Recommended Mitigation

  1. Use a mapping to track entries per raffle:
    Replace the duplicate loop with an mapping lookup per entrant. Track the current raffleId (initialized to 1), check if addressToRaffleId[player] == raffleId, and if not, update the mapping.

  2. Alternative: If raffle participants should be allowed to purchase multiple tickets (standard raffle behavior), remove the duplicate check completely.

Below is the diff for the mapping mitigation:

+ mapping(address => uint256) public addressToRaffleId;
+ uint256 public raffleId = 1;
​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
+ for (uint256 i = 0; i < newPlayers.length; i++) {
+ require(addressToRaffleId[newPlayers[i]] != raffleId, "PuppyRaffle: Duplicate player");
+ addressToRaffleId[newPlayers[i]] = raffleId;
+ players.push(newPlayers[i]);
+ }
​
- for (uint256 i = 0; i < newPlayers.length; i++) {
- players.push(newPlayers[i]);
- }
- // Check for duplicates
- for (uint256 i = 0; i < players.length; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j], "PuppyRaffle: Duplicate player");
- }
- }
emit RaffleEnter(newPlayers);
}
​
function selectWinner() external {
+ raffleId++;
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!