First Flight #2: Puppy Raffle

Summary

totalFees is uint64 which may overflow; there is uses of unsafe casting too

Vulnerability Details

Largest value uint64 solidity is 18446744073709551615 which is about 18.44 ether. Its possible for a raffle to be big ticket and have totals up to 2000 ETH such that fee can be > 19 ETH this implies uint64(fee) will overflow and lead to 0.
Additionally the total fees for a raffle with large entries can easily accumulate over 19 ETH leading to overflow totalFees

Impact

This unsafe casting and overflow prone logic may lead to fees not being accumulated into the protocol as they reset to 0 and or totalFees also overflowing and going to 0 resulting in wrong accounting and loss of value and faulty payouts

Tools Used

Manual Analysis

Recommendations

Ensure totalFees and fees are uint256

Other alternative is to use SafeCasting Libraries like OpenZeppeli