allow edits for inactive prizes

[yogurtandjam]

prizes are immediately marked as inactive and thus uneditable once all users are drawn but we often have to make updates such, such as tally form id

[octane-security-app]

Summary by Octane

New Contracts

No new contracts were added in this PR.

Updated Contracts

• Raffle.sol: Removed prizeIsActive modifier, allowing prize updates regardless of active status.

---

🔗 Commit Hash: 413f3b6

[Copilot]

Pull Request Overview

This PR removes the prizeIsActive modifier from the updatePrize function, enabling administrators to edit prize details (name, value, quantity, and form ID) even after all winners have been drawn and the prize has been marked as inactive.

Key Changes:

• Removed the prizeIsActive modifier restriction from the updatePrize function

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Removing the prizeIsActive check allows modification of prize details after the prize lifecycle has completed. This could lead to data integrity issues if prize information (name, value, quantity) is changed after winners have been determined, potentially creating inconsistencies in historical records or audit trails. Consider implementing a more granular permission system that allows editing only specific fields like formId for inactive prizes while restricting changes to core prize attributes.

[Copilot]

The comment states 'without affecting tickets or active status' but this is now misleading since the function can now modify inactive prizes. Update the comment to clarify that this function can edit both active and inactive prizes, or specify which fields should be edited after a prize becomes inactive.

Suggested change

	// Update prize details without affecting tickets or active status
	// Update prize details (name, description, value, quantity, formId) for both active and inactive prizes without affecting tickets or the active status

[ungaro]

lgtm.

[octane-security-app]

Overview

Vulnerabilities found:	7
Severity breakdown:	3 Medium, 4 Low

Warnings found:	2

Detailed findings

plume/src/spin/Raffle.sol

• Unbounded prizeIds growth and O(N) removal in Raffle causes availability degradation. See more
• Unbounded iteration in Raffle.sol getValidWinnersCount causes DoS of winner selection. See more
• Unbounded storage loop in Raffle.getValidWinnersCount used in transactional paths causes DoS of winner selection. See more
• O(n) scanning of prizeWinners via getValidWinnersCount in Raffle winner selection causes gas-driven DoS of drawing winners. See more
• No sales closure/snapshot before VRF in Raffle allows last-second entries causing unfair odds dilution. See more
• Incomplete VRF request cancellation in Raffle.sol causes unintended winner selection after cancellation. See more
• Incomplete cancellation of VRF requests in Raffle allows stale callbacks to select winners and block intended re-draws. See more

Warnings

plume/src/spin/Raffle.sol

• O(N) scan of prizeWinners in Raffle winner selection functions causes DoS of prize drawing. See more
• Unbounded iteration in Raffle.getValidWinnersCount causes gas-based DoS of winner selection. See more

---

🔗 Commit Hash: 413f3b6
🛡️ Octane Dashboard: All vulnerabilities