https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/037fa3c4-2913-4313-aaca-e8edc36c96eb.jpg

shikhar

Security Researcher

Contact Me

High

3

Total

Medium

1

Total

$9.00

Total Earnings

#2183 All Time

1x

Payouts

regular

1x

Top 25

regular

1x

Top 50

All

Sherlock

Aug '24

Winnables Raffles

Winnables Raffles

9.76 USDC • 4 total findings • Sherlock • shikhar

#25

high

`WinnablesTicketManager::refundPlayers` function not decrementing the `_lockedETH` will result in reduced balance admin can withdraw for token sales.

high

`WinnablesTicketManager::cancelRaffle` function allowing anyone to cancel a Raffle when it is in `PRIZE_LOCKED` state leads to DoS to create a raffle via `createRaffle`

high

`_sendCCIPMessage` not validating destination contract and chain selector allows users to pass arbitrary values and leads to message not being delivered to desired contract, which further leads to multiple issues.

medium

`Roles::_setRole` doesn't consider the `status`, prevents admins to remove roles.