First Flight #2: Puppy Raffle

Summary

PuppyRaffle::withdrawFees() will suffer from DoS because as soon as the winner is selected one can have bots call the enterRaffle function and as a result of which it will always revert because the totalFees will not remain equal to the PuppyRaffle contract's balance as people entered the raffle and it will prevent the fee address from claiming the fees.
Alternatively attackers can also deploy their own attack contract with minimal balance in it and send it to PuppyRaffle, as result of which totalFees != address of PuppyRaffle contract and it will always revert.

Vulnerability Details

There are two ways to cause withdrawFees() to suffer from DoS-

• As soon as the winner is selected bots will call the enter raffle function which will make totalFees != address(this).balance then fee address can never claim the fees.

• Also, attacker can create their own contract containing self destruct which will send the funds to PuppyRaffle contract. totalAmountCollected will calculate the amount collected from new players, and 80% will be sent to winners and 20% will be added to totalFees, but as attacker sent some amount via self destruct to PuppyRaffle thus the condition totalFees == PuppyRaffle balance will always return false as balance of contract will always be more than fees even if there are no players as the attacker sent the amount, thus it will prevent fee address from claiming the fees.
  So, by deploying an AttackContract with 1 wei as balance and then call the self destruct within their contract which sends eth to PuppyRaffle thus creating DoS for withdrawFees function.

Impact

Fee Address can never claim their fees.

Tools Used

Manual Review

Recommendations

To send the fees to fee address in the selectWinner function only.