First Flight #2: Puppy Raffle

Summary

'refund' function can be used to perform a reentrancy attack

Vulnerability Details

In the 'refund' function we try to send ether to the msg.sender using 'sendValue' function from OZ (which uses the 'call' method to send ether and is also a recommended method but only if it's used with a reentrancy guard/modifier.

Impact

Somebody can drain the ETH balance of the smart contract

Tools Used

Manual review

Recommendations

Move the 'players[playerIndex] = address(0);' line above the 'payable(msg.sender).sendValue(entranceFee);' or use Reentrancy Guard by OZ