First Flight #2: Puppy Raffle

Summary

Refund function is vulnerable to reentrency attack.

Vulnerability Details

If the user is a smart contract, it can call refund function and have a fallback function which will be run when receive the ether, and call again refund until all the funds are drained.

Impact

All the funds can be drained.

Tools Used

Solidity.

Recommendations

Either move the line "players[playerIndex] = address(0);" BEFORE "payable(msg.sender).sendValue(entranceFee);"
Or use a lock like "nonReentrant" from OpenZeppelin ReentrancyGuard.