> For the complete documentation index, see [llms.txt](https://reports.immunefi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://reports.immunefi.com/plume-or-attackathon/52918-sc-insight-redundant-check-for-allwinnersdrawn-error.md).

# 52918 sc insight redundant check for allwinnersdrawn error

Submitted on Aug 14th 2025 at 09:45:35 UTC by @Finlooz4 for [Attackathon | Plume Network](https://immunefi.com/audit-competition/plume-network-attackathon)

* Report ID: #52918
* Report Type: Smart Contract
* Report severity: Insight
* Target: <https://github.com/immunefi-team/attackathon-plume-network/blob/main/plume/src/spin/Raffle.sol>

## Description

This report identifies a redundant error check in the `requestWinner` function: an explicit `AllWinnersDrawn` check duplicates behavior already enforced by the prize deactivation mechanism and thus is unnecessary.

## Brief / Intro

The raffle contract contains a redundant `AllWinnersDrawn` error check in `requestWinner`. The same restriction is enforced by deactivating the prize once all winners have been drawn and by checks that prevent reactivation of completed prizes. The redundant check increases code complexity and consumes small amounts of additional gas.

## Vulnerability Details

The `requestWinner` function contains a redundant `AllWinnersDrawn` check:

```solidity
if (winnersDrawn[prizeId] >= prizes[prizeId].quantity) revert AllWinnersDrawn();
```

This is redundant because:

* When the last winner is selected, `handleWinnerSelection` deactivates the prize:

```solidity
if (winnersDrawn[prizeId] == prizes[prizeId].quantity) {
    prizes[prizeId].isActive = false;
}
```

* `requestWinner` already checks the prize active status:

```solidity
require(prizes[prizeId].isActive, "Prize not available");
```

* `setPrizeActive` prevents reactivation of completed prizes:

```solidity
if (active) {
    require(winnersDrawn[prizeId] < prize.quantity, "All winners already selected");
}
```

Because of the deactivation and reactivation prevention, attempting to request another winner after all winners are drawn will already revert via the `isActive` check. The explicit `AllWinnersDrawn` check therefore adds no additional protection.

{% hint style="info" %}
The redundant check does not introduce a security vulnerability that allows incorrect behavior — it only increases gas usage and code complexity.
{% endhint %}

## Impact Details

* Unnecessary condition check consumes extra gas.
* No change in functional behavior or security guarantees; both the redundant check and the active-check path correctly prevent additional winner requests.

## Proof of Concept

{% stepper %}
{% step %}

### Create a prize with quantity = 1

Create a prize whose `quantity` is 1.
{% endstep %}

{% step %}

### Call requestWinner() and process VRF callback

* `winnersDrawn` increments to 1.
* Prize deactivated (`isActive = false`).
  {% endstep %}

{% step %}

### Attempt to call requestWinner() again

* With the redundant check: reverts with `AllWinnersDrawn` error.
* Without the redundant check: reverts with "Prize not available".
  {% endstep %}

{% step %}

### Both outcomes correctly prevent additional winner requests

Both revert conditions prevent drawing another winner after the prize is completed.
{% endstep %}

{% step %}

### Conclusion

The custom `AllWinnersDrawn` error provides no functional advantage over the existing active-status check and related reactivation prevention.
{% endstep %}
{% endstepper %}

## References

<details>

<summary>Related code snippets / links</summary>

* Target file: <https://github.com/immunefi-team/attackathon-plume-network/blob/main/plume/src/spin/Raffle.sol>

(See the functions and checks quoted above in the Vulnerability Details section.)

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://reports.immunefi.com/plume-or-attackathon/52918-sc-insight-redundant-check-for-allwinnersdrawn-error.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.