Audit report published Oct 2025. Solidity.
| Severity | Count |
|---|---|
| Critical | 3 |
| High | 2 |
| Medium | 2 |
| Low | 7 |
| Informational | 10 |
| Total | 24 |
Safe Edges reviewed the Raffl3 raffle contracts (RaffleFactory, RafflePool, PoolTierManager, SignatureVerifier and RaffleVrfRouter) between 18 and 28 September 2025. Twenty-four issues were identified: three Critical, two High, two Medium, seven Low and ten Informational, three of which are gas optimisations. The Critical issues concerned unvalidated winner addresses that could lock user funds, missing access control on VRF requests that could block pools, and biased winner selection. All Critical, High, Medium and Low issues were fixed; of the Informational issues, five were fixed and five acknowledged.
C-01 Lack of winner address validation in RafflePool._fulfillTierPool() can potentially locks user's funds in pool contract forever — ResolvedC-02 Improper access control in RaffleVrfRouter.requestRng can cause pool DoS — ResolvedC-03 Biased and Flawed Winner Selection Mechanism in RafflePool._fulfillTierPool — ResolvedH-01 Absence of Robust Signature Replay Protection in SignatureVerifier.verifySignature — ResolvedH-02 Incomplete Processing Fee Calculation in RafflePool.getTotalPrizeForUser and RafflePool.claim- Prize leads to revenue loss — ResolvedM-01 Missing validation on prizeAmounts total in PoolTierManager.updateTierConfig — ResolvedM-02 Pool ownership tracking broken in RaffleFactory.createPool function — ResolvedL-01 Missing validation on maxTicketsPerAddress relative to totalTickets in RaffleFactory._validatePoolParams — ResolvedL-02 Missing check whether _owner is wallet address or not in RaffleVrfRouter contract — ResolvedL-03 Missing validation on totalTickets in RaffleFactory._validatePoolParams — ResolvedL-04 Duplicate Ticket Numbers in Single Purchase Cause ticketsSold Accounting Discrepancy in Raffle- Pool.buyTickets — ResolvedL-05 False Event Emission in RafflePool._fulfillTierPool — ResolvedL-06 Missing endTime Check Before Drawing in RafflePool.requestDraw — ResolvedL-07 Potential Out-Of-Gas Risk in RafflePool._fulfillTierPool — ResolvedI-01 Ineffective onlyValidFactory Modifier — ResolvedI-02 Lack of Ticket Availability Function in RafflePool Causes Failed Purchases and Wasted Gas — AcknowledgedI-03 Incomplete Validation of ticketPrice in RaffleFactory._validatePoolParams — AcknowledgedI-04 Use Ownable2StepUpgradeable instead of OwnableUpgradeable — AcknowledgedI-05 Few Important State Change Lacks Event Emission — AcknowledgedI-06 RaffleVrfRouter.myCallback does not follow the CEI pattern — ResolvedI-07 No Refund Mechanism for Users — AcknowledgedG-01 Avoid redundant logic and unnecessary state variables to reduce gas — ResolvedG-02 Unused Error — ResolvedG-03 Dead Code — ResolvedSend the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.