First Flight #2: Puppy Raffle

Summary

The contracts only allow users to get a refund up to the amount of the entrance fee when they paid an amount higher than the fee to enter the raffle. Unless explicitly stated, the refund function should send the total amount users paid for the raffle rather than using entrancefee as the msg.value.

Vulnerability Details

Impact

Tools Used

Manual Review

Recommendations

There should be a mapping which keep tracks of the amount user has in the contract and also send that balance as the refund.