First Flight #2: Puppy Raffle

Summary

Zero address may be selected as a winner due to the wrong setting in refund.

Vulnerability Details

The refund does not update the players correctly. It only sets the address to zero but does not remove it from the array. When selectWinner is called, it still includes the refunded player in the list of active players. This can result in the wrong player being selected as the winner and receiving the prize.

Impact

The prize pool may be sent to a zero address.

Tools Used

Manual review.

Recommendations

Remove the player from players when the refund is called.