Anish-Agnihotri / MultiRaffle

NFT distribution with (1) randomized, multi-winner raffles and (2) bulk on-chain metadata generation.
GNU Affero General Public License v3.0
269 stars 52 forks source link

Can claim Raffle be exploited? #11

Open sssubik opened 2 years ago

sssubik commented 2 years ago

Hey nice stuff!

uint256 winningTickets = nftCount - tmpCount;

 if (winningTickets != tickets.length) {
            // Payout value equal to number of bought tickets - paid for winning tickets
            (bool sent, ) = payable(msg.sender).call{
                value: (tickets.length - winningTickets) * MINT_COST
            }("");
            require(sent, "Unsuccessful in refund");
        }

here there is cpmparison of winning ticket != tickets.length.

What if number of tickets is 100 and nobody is a winner. since there is no winner winningTickets is 0. And the function will transfer the money as refund?

Am I missing something?