Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

O(n²) duplicate check in `PuppyRaffle::enterRaffle` makes entry progressively more expensive, then impossible

furkanumut

Root + Impact

Description

Normally, adding a new player to a raffle should cost roughly constant gas regardless of how many already entered. However, in the current implementation every call compares every pair of slots in the ever-growing players array, so each new entrant pays more than the previous one.

The vulnerability exists in PuppyRaffle.sol#L79-L92.

Root Cause: Denial of service — unbounded O(n²) loop over a user-grown dynamic array.

Vulnerable Code:

// File: src/PuppyRaffle.sol — Lines 79–92
​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
players.push(newPlayers[i]);
}
​
// Check for duplicates
@> for (uint256 i = 0; i < players.length - 1; i++) { // BUG: re-scans ALL existing players...
@> for (uint256 j = i + 1; j < players.length; j++) { // ...against all others, on every call
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}
emit RaffleEnter(newPlayers);
}

Why This Is Exploitable:

The duplicate check runs over players.length (all historical entrants), not just newPlayers. For an array of size n, it performs ~n²/2 storage reads and comparisons per call. Measured on the in-scope contract, a 50-player enterRaffle call costs 2,236,012 gas when 50 players exist and 27,211,061 gas when 250 exist — already near the ~30M Ethereum block gas limit. The next 50-player batch extrapolates to ~39M gas, making further entry impossible until a winner is selected and the array is reset.

Risk

Likelihood:

  • Happens naturally as the raffle grows; no attacker is required — every new entrant bears a strictly higher cost.

  • An attacker can also accelerate it by entering many sybil addresses early, raising the price of entry for everyone else.

Impact:

  • Temporary per-round denial of service of a core protocol function: beyond ~250–300 players nobody can enter until settlement.

  • Early entrants gain an economic advantage over later ones (strictly increasing gas cost per ticket).

Proof of Concept

function testPoC_EnterRaffleDuplicateCheckGasGrows() public {
vm.deal(address(this), entranceFee * 250);
uint256[5] memory gasUsed;
for (uint256 batch = 0; batch < 5; batch++) {
address[] memory p = new address[](50);
for (uint256 i = 0; i < 50; i++) {
p[i] = address(uint160(batch * 50 + i + 5000));
}
uint256 g0 = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * 50}(p);
gasUsed[batch] = g0 - gasleft();
console2.log("total players:", (batch + 1) * 50, "gas for this 50-player call:", gasUsed[batch]);
}
// each later batch pays strictly more gas than the previous one
assertGt(gasUsed[4], gasUsed[3]);
assertGt(gasUsed[3], gasUsed[2]);
assertGt(gasUsed[2], gasUsed[1]);
assertGt(gasUsed[1], gasUsed[0]);
}

Run: forge test --match-test testPoC_EnterRaffleDuplicateCheckGasGrows -vv

Output (actual run):

[PASS] testPoC_EnterRaffleDuplicateCheckGasGrows() (gas: 63210811)
Logs:
total players: 50 gas for this 50-player call: 2236012
total players: 100 gas for this 50-player call: 5332473
total players: 150 gas for this 50-player call: 10540336
total players: 200 gas for this 50-player call: 17833198
total players: 250 gas for this 50-player call: 27211061

  1. Fresh raffle, 1 ETH ticket.

  2. Enter players in five consecutive batches of 50 and measure the gas of each enterRaffle call.

  3. Each batch costs strictly more gas than the previous one (2.24M → 5.33M → 10.54M → 17.83M → 27.21M), demonstrating quadratic growth toward the block gas limit.

Recommended Mitigation

Track active players in a mapping and check each new entrant in O(1), so entry cost stays constant regardless of array size (clear the mapping on refund and on round reset):

Proposed Fix:

// File: src/PuppyRaffle.sol
​
- for (uint256 i = 0; i < players.length - 1; i++) {
- for (uint256 j = i + 1; j < players.length; j++) {
- require(players[i] != players[j], "PuppyRaffle: Duplicate player");
- }
- }
+ for (uint256 i = 0; i < newPlayers.length; i++) {
+ require(!isActivePlayer[newPlayers[i]], "PuppyRaffle: Duplicate player");
+ isActivePlayer[newPlayers[i]] = true;
+ }

References:

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!