Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

enterRaffle's O(n^2) duplicate check makes entry cost grow quadratically, allowing a gas-limit denial of service

alphalens

Root + Impact

  • enterRaffle checks for duplicate players with a nested loop over the entire players array, making the gas cost grow with the square of the number of players. As the raffle fills, entering becomes prohibitively expensive and eventually exceeds the block gas limit, freezing new entries.

Description

  • enterRaffle() should let new players join at a roughly constant, predictable gas cost regardless of how many players are already in the raffle.

  • After pushing the new players, the function runs a nested loop comparing every pair of entries, which is O(n^2). Each additional player makes the next entry more expensive, and an attacker can front-load many entries to push the cost toward the block gas limit.

@> for (uint256 i = 0; i < players.length - 1; i++) {
@> for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}

Risk

Likelihood:

  • This occurs naturally as a popular raffle accumulates players, since every entry re-scans the whole array.

  • An attacker can deliberately enter a large number of addresses early to inflate the array and price later honest players out.

Impact:

  • Impact 1: Later entrants pay steeply escalating gas, and eventually enterRaffle exceeds the block gas limit so no one can enter, freezing the raffle.

  • Impact 2: An attacker can cheaply grief the raffle, denying entry to honest users and undermining fairness.

Proof of Concept

  • Entering a second batch of 100 players costs dramatically more gas than the first batch of 100, even though the batch size is identical. This demonstrates the quadratic growth that leads to a block-gas-limit lockout.

function test_EnterRaffleGasGrowsQuadratically() public {
address[] memory first = _makePlayers(100, 0);
uint256 gasStartA = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * 100}(first);
uint256 gasA = gasStartA - gasleft();
​
address[] memory second = _makePlayers(100, 100);
uint256 gasStartB = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * 100}(second);
uint256 gasB = gasStartB - gasleft();
​
// Same batch size, but the second batch is far more expensive
assertGt(gasB, gasA * 3);
}
​
// helper: builds `count` distinct addresses starting at `offset`
function _makePlayers(uint256 count, uint256 offset) internal pure returns (address[] memory ps) {
ps = new address[](count);
for (uint256 i = 0; i < count; i++) {
ps[i] = address(uint160(offset + i + 1));
}
}

Recommended Mitigation

  • Replace the O(n^2) nested loop with an O(1) membership check using a mapping. Track whether each address has already entered, so entry cost stays constant regardless of the number of players.

- for (uint256 i = 0; i < players.length - 1; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j], "PuppyRaffle: Duplicate player");
- }
- }
+ for (uint256 i = 0; i < newPlayers.length; i++) {
+ require(!isPlayer[newPlayers[i]], "PuppyRaffle: Duplicate player");
+ isPlayer[newPlayers[i]] = true;
+ }
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 5 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!