First Flight #2: Puppy Raffle

Summary

A re-entrancy vulnerability in refund() can allow the attacker to drain all funds.

Vulnerability Details

refund() is sending native ether to the account msg.sender which will trigger a callback if the msg.sender account is a smart contract. Because the state variable players is not cleared for playerIndex before the callback is triggered, an attacker can re-enter refund() and have it send more native ether to msg.sender.

Impact

This will result in all the funds being drained out of the contract.

Tools Used

Manual review

Recommendations

Make the state changes before sending ether or use non-reentrant libraries or locks/mutexes.