First Flight #2: Puppy Raffle

Summary

Winner can be address(0)

Vulnerability Details

1. enterRaffle() does not check individual accounts in passed in array are not address(0)

2. If an account claims refund the index is zeroed out to address(0) however this index is still eligible for being selected as the index for winner

Impact

Selected winner can be address(0). Funds are sent to address which will succeed due to low level call as if an actual winner won something when there is no winner

Tools Used

Manual Analysis

Recommendations

Ensure checks in enterRaffle that address(0) is not allowed
Ensure checks after refund that zeroed out index can no longe be selected as winner