Winnables Raffles audit contest

A public audit contest on Sherlock (raffle), completed on 16th August 2024. 0xSimao placed #3. 6 of his findings are published: 3 high severity and 3 medium.

What Winnables Raffles is

Winnables is an on-chain raffle platform: prizes in ETH, tokens or NFTs are locked on Ethereum mainnet, tickets are sold on Avalanche, Chainlink VRF draws the winner, and CCIP messages carry the result back so the prize unlocks for the right address.

Scope

The raffle and prize managers on their two chains and the CCIP messaging between them.

High severity findings

• Users will lock raffle prizes on the WinnablesPrizeManager contract by calling WinnablesTicketManager::propagateRaffleWinner with wrong CCIP inputs
• Attacker will prevent any raffles by calling WinnablesTicketManager::cancelRaffle before admin starts raffle
• Method refundPlayers doesn't update _lockedETH in WinnableTicketManager

Medium severity findings

• Admin can unrestrictedly affect the odds of a raffle by setting themselves up with role(1) in WinnablesTicket
• Admin can prevent raffle winner from claiming their reward
• Users buying too many tickets will DoS them and the protocol if they are the winner due to OOG

The contest

View the contest page