# Admin can prevent raffle winner from claiming their reward Medium · Sherlock · Raffle · 16th August 2024 Finding M-4 of the Winnables Raffles competition. - Protocol: https://audits.sherlock.xyz/contests/516 - Codebase: https://github.com/0xsimao/2024-08-winnables-raffles/tree/81b28633d0f450e33a8b32976e17122418f5d47e - Source: https://github.com/sherlock-audit/2024-08-winnables-raffles-judging/issues/277 --- ### Summary By whitelisting their address and sending a WINNER_DRAWN CCIP message to PrizeManager, Admin can steal the raffle prize, which breaks the invariant from README: > Winnables admins cannot do anything to prevent a winner from withdrawing their prize ### Root Cause In WinnablesPrizeManager, Admin can [add/remove](https://github.com/sherlock-audit/2024-08-winnables-raffles/blob/81b28633d0f450e33a8b32976e17122418f5d47e/public-contracts/contracts/WinnablesPrizeManager.sol#L134) any address as CCIP counterpart at any time. ### Internal pre-conditions A raffle is able to reach REQUESTED stage (enough tickets were sold). ### Attack Path 1. Admin sends NFT (or token/ETH) to PrizeManager. 2. Admin calls PrizeManager#lockNFT. 3. Admin calls TicketManager#createRaffle. 4. Raffle (ticket sale) ends successfully. 5. drawWinner is called. 6. Admin adds himself as PrizeManager's CCIP counterpart and sends WINNER_DRAWN CCIP message with his own address as `winner` to PrizeManager; Admin removes TicketManager from PrizeManager's CCIP counterparts. 7. Chainlink VRF request from step 5 is fulfilled. 8. TicketManager#propagate is called, which propagates Alice as the winner of the raffle, but CCIP message reverts on the destination chain with `UnauthorizedCCIPSender()`. 8. Admin claims reward from PrizeManager. ### Impact Admin steals the raffle reward. ### Mitigation Admin should not be able to add or remove CCIP counterparts during Raffles.