First Flight #2: Puppy Raffle

Summary

selfdestruct can send ether to the protocol and cause the requirement in withdraw to fail, leading to denial of service.

Vulnerability Details

Since the contract can receive ether without receive or fallback function if malicious user can selfdestruct their contract and send the ether to victim contract. In this case, the contract balance can exceed the value of totalFees.

Impact

This will lead to the denial of service and the user cannot withdraw the ether from the protocol. All the token will be locked in the contract.

Tools Used

manual review

Recommendations

Use require(address(this).balance >= uint256(totalFees)) instead