First Flight #2: Puppy Raffle

Summary

Contracts are ownable and nothing states account is not a single party.

Vulnerability Details

Single account or party to ownership of contracts can lose access to private key so functionality like changing fees, withdrawing fees(assuming access control fixed) cant be done;

Impact

If private keys compromised new owner can steal fees by passing in address under their control.
If owner goes rogue in case they represent other parties they can also take the fees for themselves.
Ownership can be lost leading to fees being lost in the protocol

Tools Used

Manual Analysis

Recommendations

Recommended ownership of contracts be a MultiSig or Governance or DAO to limit centralization risk to single account party