Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

M-2 selectWinner can crown a refunded hole

hatchworker

Root + Impact

Description

[MEDIUM] M-2 selectWinner can crown a refunded hole

winnerIndex can land on an address(0) slot left by refund(): the prize is called to the zero address (burned) and _safeMint(address(0), tokenId) reverts ("ERC721: mint to the zero address"), DoS-ing the round even if M-1 were fixed.

Risk

  • Likelihood: Medium — any refund creates a zeroed slot that the winner draw can hit.

  • Impact: Medium — prize pool funds burned / round can never complete.

Proof of Concept

PoC: forced a hole landing, observed the revert.

Recommended Mitigation

Skip/compact zeroed slots before picking the winner.

- address winner = players[winnerIndex];
+ // skip address(0) holes or compact the array on refund
+ address winner = players[winnerIndex];
+ require(winner != address(0), "hole");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-01] Potential Loss of Funds During Prize Pool Distribution

## Description In the `selectWinner` function, when a player has refunded and their address is replaced with address(0), the prize money may be sent to address(0), resulting in fund loss. ## Vulnerability Details In the `refund` function if a user wants to refund his money then he will be given his money back and his address in the array will be replaced with `address(0)`. So lets say `Alice` entered in the raffle and later decided to refund her money then her address in the `player` array will be replaced with `address(0)`. And lets consider that her index in the array is `7th` so currently there is `address(0)` at `7th index`, so when `selectWinner` function will be called there isn't any kind of check that this 7th index can't be the winner so if this `7th` index will be declared as winner then all the prize will be sent to him which will actually lost as it will be sent to `address(0)` ## Impact Loss of funds if they are sent to address(0), posing a financial risk. ## Recommendations Implement additional checks in the `selectWinner` function to ensure that prize money is not sent to `address(0)`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!