First Flight #2: Puppy Raffle

Summary

withdrawFees() has a strict check against address(this).balance such that bad actors could intentionally send in 1 wei to DoS it.

Vulnerability Details

The address(this).balance == uint256(totalFees) check could be easily manipulated by sending 1 wei into the PuppyRaffle contract. Since there's no payable fallback function in PuppyRaffle, we could use the selfdestruct to achieve that as follows:

When we create a Exp contract with 1 wei paid and kill() it with PuppyRaffle address, address(this).balance would be uint256(totalFees) + 1 such that the check in withdrawFees() would not pass.

Impact

Fees cannot be collected

Tools Used

Manual review

Recommendations

Check players.length to see if there's any active palyer