F-2024-0001·incorrect-validation

Nearly impossible for any user to register to the raffle

Acknowledgeddexammraffle
TL;DR

register() in MonadexV1Raffle compares ticketsToBurn against the user balance with the wrong operator and reverts in either branch, blocking every registration and breaking the raffle entirely.

Severity
CRITICAL
Impact
HIGH
Likelihood
HIGH
Method
MManual review
CAT.
Complexity
LOW
Exploitability
HIGH
02Section · Description

Description

The register() function in the MonadexV1Raffle contract contains a critical logic error that prevents any user from successfully registering for the raffle. The function incorrectly checks the user's balance against the number of tickets to burn, causing it to revert in all scenarios.

  • If ticketsToBurn < balance, the function reverts, preventing registration even when the user has sufficient balance.
  • If ticketsToBurn >= balance, the function will likely revert in the _burn call due to insufficient balance.
03Section · Impact

Impact

This vulnerability completely breaks the core functionality of the raffle system, making it impossible for any user to register. As a result, the entire contract becomes non-functional, effectively creating a denial of service for the raffle feature. If deployed, this critical flaw would likely lead to a significant loss of user trust and damage to the protocol's reputation, as users would be unable to participate in the raffle despite potentially having purchased tickets.

04Section · Recommendation

Recommendation

Correct the balance check logic so that the revert only triggers when the user truly cannot cover the ticket burn:

solidity
function register(uint256 _amount) external notZero(_amount) returns (uint256) {
// ... (previous checks)
uint256 balance = balanceOf(msg.sender);
uint256 ticketsToBurn = slotsToOccupy * RANGE_SIZE;
if (ticketsToBurn > balance) {
revert MonadexV1Raffle__NotEnoughBalance(ticketsToBurn, balance);
}
// ... (rest of the function)
}
F-2024-0001

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx