Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

enterRaffle's nested duplicate check is O(n²) over an unbounded array — gas grows quadratically, pricing out and eventually blocking entry (DoS)

hopeh

Description

enterRaffle checks for duplicate entrants with a nested loop over the entire, ever-growing players array:

function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
players.push(newPlayers[i]);
}
​
// Check for duplicates — O(n^2) over ALL players so far
for (uint256 i = 0; i < players.length - 1; i++) {
for (uint256 j = i + 1; j < players.length; j++) {
require(players[i] != players[j], "PuppyRaffle: Duplicate player");
}
}
emit RaffleEnter(newPlayers);
}

The duplicate check compares every pair in players, so its cost is O(n²) in the current number of players. Each players[i] != players[j] also reads from storage. As the raffle fills up, the gas required to enter grows quadratically:

  • The 4th entrant pays for a handful of comparisons.

  • The 100th entrant pays for ~5,000 comparisons.

  • The 1,000th entrant pays for ~500,000 storage-read comparisons.

Two harmful effects:

  1. Unfair, escalating cost. Early entrants pay almost nothing to enter; later entrants pay dramatically more for the identical action. The entrance is not equitable.

  2. Denial of service. An attacker can cheaply pad the players array early (entering many addresses in one call), inflating players.length so much that subsequent enterRaffle calls exceed the block gas limit and revert. Once that threshold is reached, no one else can enter — the raffle is frozen for honest users.

The duplicate check does not need to be O(n²); the quadratic array scan is the root cause.

Risk

Impact: Medium. Entry becomes progressively more expensive and can be pushed past the block gas limit, denying honest users the ability to participate and undermining the fairness of the raffle. No direct theft, but a griefer can brick the core entry path.

Likelihood: High. No privileges required; anyone can enter a large batch of addresses to inflate the array, and the cost escalation happens naturally as the raffle grows.

Proof of Concept

function test_enterRaffleGasGrowsQuadratically() public {
// First batch of 100 entrants
address[] memory first = _makeAddresses(100, 1);
uint256 g0 = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * 100}(first);
uint256 gasFirst = g0 - gasleft();
​
// Second batch of 100 entrants — same action, much later in the array
address[] memory second = _makeAddresses(100, 1000);
uint256 g1 = gasleft();
puppyRaffle.enterRaffle{value: entranceFee * 100}(second);
uint256 gasSecond = g1 - gasleft();
​
// The second identical batch costs multiples of the first (quadratic blow-up)
assertGt(gasSecond, gasFirst * 3);
}

Expected: entering costs roughly the same regardless of how many players already entered. Actual: cost scales with the square of the current player count, up to full denial of service.

Recommended Mitigation

Replace the O(n²) array scan with O(1) duplicate detection using a mapping, so cost does not depend on the number of existing players:

mapping(address => bool) public isPlayer;
​
function enterRaffle(address[] memory newPlayers) public payable {
require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle");
for (uint256 i = 0; i < newPlayers.length; i++) {
require(!isPlayer[newPlayers[i]], "PuppyRaffle: Duplicate player");
isPlayer[newPlayers[i]] = true;
players.push(newPlayers[i]);
}
emit RaffleEnter(newPlayers);
}

(Remember to clear the mapping on refund/selectWinner reset, or track entries per-raffle round.) This makes entry cost constant per player and removes the DoS surface.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] `PuppyRaffle: enterRaffle` Use of gas extensive duplicate check leads to Denial of Service, making subsequent participants to spend much more gas than prev ones to enter

## Description `enterRaffle` function uses gas inefficient duplicate check that causes leads to Denial of Service, making subsequent participants to spend much more gas than previous users to enter. ## Vulnerability Details In the `enterRaffle` function, to check duplicates, it loops through the `players` array. As the `player` array grows, it will make more checks, which leads the later user to pay more gas than the earlier one. More users in the Raffle, more checks a user have to make leads to pay more gas. ## Impact As the arrays grows significantly over time, it will make the function unusable due to block gas limit. This is not a fair approach and lead to bad user experience. ## POC In existing test suit, add this test to see the difference b/w gas for users. once added run `forge test --match-test testEnterRaffleIsGasInefficient -vvvvv` in terminal. you will be able to see logs in terminal. ```solidity function testEnterRaffleIsGasInefficient() public { vm.startPrank(owner); vm.txGasPrice(1); /// First we enter 100 participants uint256 firstBatch = 100; address[] memory firstBatchPlayers = new address[](firstBatch); for(uint256 i = 0; i < firstBatchPlayers; i++) { firstBatch[i] = address(i); } uint256 gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * firstBatch}(firstBatchPlayers); uint256 gasEnd = gasleft(); uint256 gasUsedForFirstBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the first 100 partipants is:", gasUsedForFirstBatch); /// Now we enter 100 more participants uint256 secondBatch = 200; address[] memory secondBatchPlayers = new address[](secondBatch); for(uint256 i = 100; i < secondBatchPlayers; i++) { secondBatch[i] = address(i); } gasStart = gasleft(); puppyRaffle.enterRaffle{value: entranceFee * secondBatch}(secondBatchPlayers); gasEnd = gasleft(); uint256 gasUsedForSecondBatch = (gasStart - gasEnd) * txPrice; console.log("Gas cost of the next 100 participant is:", gasUsedForSecondBatch); vm.stopPrank(owner); } ``` ## Recommendations Here are some of recommendations, any one of that can be used to mitigate this risk. 1. User a mapping to check duplicates. For this approach you to declare a variable `uint256 raffleID`, that way each raffle will have unique id. Add a mapping from player address to raffle id to keep of users for particular round. ```diff + uint256 public raffleID; + mapping (address => uint256) public usersToRaffleId; . . function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); + usersToRaffleId[newPlayers[i]] = true; } // Check for duplicates + for (uint256 i = 0; i < newPlayers.length; i++){ + require(usersToRaffleId[i] != raffleID, "PuppyRaffle: Already a participant"); - for (uint256 i = 0; i < players.length - 1; i++) { - for (uint256 j = i + 1; j < players.length; j++) { - require(players[i] != players[j], "PuppyRaffle: Duplicate player"); - } } emit RaffleEnter(newPlayers); } . . . function selectWinner() external { //Existing code + raffleID = raffleID + 1; } ``` 2. Allow duplicates participants, As technically you can't stop people participants more than once. As players can use new address to enter. ```solidity function enterRaffle(address[] memory newPlayers) public payable { require(msg.value == entranceFee * newPlayers.length, "PuppyRaffle: Must send enough to enter raffle"); for (uint256 i = 0; i < newPlayers.length; i++) { players.push(newPlayers[i]); } emit RaffleEnter(newPlayers); } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!