# Winnables Raffles audit contest Sherlock · Raffle · 16th August 2024 · #3 A public audit contest on Sherlock (raffle), completed on 16th August 2024. 0xSimao placed #3. 6 of his findings are published: 3 high severity and 3 medium. ## What Winnables Raffles is Winnables is an on-chain raffle platform: prizes in ETH, tokens or NFTs are locked on Ethereum mainnet, tickets are sold on Avalanche, Chainlink VRF draws the winner, and CCIP messages carry the result back so the prize unlocks for the right address. ## Scope The raffle and prize managers on their two chains and the CCIP messaging between them. ## High severity findings - [Users will lock raffle prizes on the `WinnablesPrizeManager` contract by calling `WinnablesTicketManager::propagateRaffleWinner` with wrong CCIP inputs](https://0xsimao.com/findings/winnables-raffles-lock-propagate-ccip-inputs) - [Attacker will prevent any raffles by calling `WinnablesTicketManager::cancelRaffle` before admin starts raffle](https://0xsimao.com/findings/winnables-raffles-raffles-winnables-raffle-starts) - [Method refundPlayers doesn't update _lockedETH in WinnableTicketManager](https://0xsimao.com/findings/winnables-raffles-refund-locked-eth-winnable) ## Medium severity findings - [Admin can unrestrictedly affect the odds of a raffle by setting themselves up with role(1) in `WinnablesTicket`](https://0xsimao.com/findings/winnables-raffles-unrestrictedly-affect-odds-themselves) - [Admin can prevent raffle winner from claiming their reward](https://0xsimao.com/findings/winnables-raffles-raffle-winner-claiming-reward) - [Users buying too many tickets will DoS them and the protocol if they are the winner due to OOG](https://0xsimao.com/findings/winnables-raffles-buying-tickets-winner-oog) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/516)