52937 sc insight redundant raffle ticket balance check
Previous51502 sc low enabling transfer restrictions permanently blocks minting and burningNext50691 sc insight no validator limit can lead to dos
Was this helpful?
Submitted on Aug 14th 2025 at 12:15:38 UTC by @Am3nh3l for Attackathon | Plume Network
Report ID: #52937
Report Type: Smart Contract
Report severity: Insight
Target: https://github.com/immunefi-team/attackathon-plume-network/blob/main/plume/src/spin/Spin.sol
Impacts:
The Spin contract contains a redundant balance check in its spendRaffleTickets function that duplicates functionality already implemented in the Raffle contract. This creates unnecessary gas overhead and code redundancy without adding security benefits.
The Raffle contract already performs a sufficient ticket balance check before calling spendRaffleTickets:
// Raffle.sol - Line 194
(,,,, uint256 userRaffleTickets,,) = spinContract.getUserData(msg.sender);
if (userRaffleTickets < ticketAmount) revert InsufficientTickets();Despite this, the Spin contract repeats the same check:
This redundancy exists because:
The Raffle contract is the only caller (via onlyRaffleContract)
The Raffle contract already verifies sufficient balance
The Spin contract cannot be called independently for ticket spending
(Impact details not provided in original report.)
(Add any relevant links to documentation or code)
(Proof of Concept not provided in original report.)
Insight
Was this helpful?
Was this helpful?
function spendRaffleTickets(address user, uint256 amount) external onlyRaffleContract {
UserData storage userDataStorage = userData[user];
require(userDataStorage.raffleTicketsBalance >= amount, "Insufficient raffle tickets");
// ...
}