F-2024-0016·missing-event

User uninformed of unused tickets after registering for raffle

Acknowledgeddexammraffle
TL;DR

Registration rounds the ticket count down to whole slots, leaving a remainder unused. The contract does not surface this to the caller, so users do not know their balance still holds unconsumed tickets.

Severity
LOW
Impact
LOW
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The current implementation of the raffle ticket system in the MonadexV1Raffle contract may result in users having unused tickets due to the rounding that occurs when calculating the number of slots a user can occupy.

The contract divides the user's ticket amount by the range size and then multiplies it back, which can lead to some tickets being unused in the raffle. However, the contract does not explicitly inform users about these unused tickets, which may remain in their balance.

03Section · Impact

Impact

Users may be unaware that they have unused tickets after participating in a raffle. This could lead to confusion about their actual ticket balance. That also means that users might miss opportunities to use these tickets in future raffles.

04Section · Recommendation

Recommendation

  • Implement a mechanism to calculate and track unused tickets:
solidity
uint256 unusedTickets = _amount % RANGE_SIZE;
  • Return the number of unused tickets to the user when they register for a raffle:
solidity
function register(uint256 _amount) external notZero(_amount) returns (uint256, uint256) {
// ... existing code ...
return (ticketsToBurn, unusedTickets);
}
  • Emit an event that includes information about unused tickets:
solidity
emit Registered(msg.sender, ticketsToBurn, unusedTickets);
F-2024-0016

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx