First Flight #2: Puppy Raffle

Summary

Incorrect downcast will result in less fees being collected and some fees being stuck in the contract.

Vulnerability Details

Fees are accumulated accross raffles in totalFees. But it is calculated as a sum and uint64 downcast:
totalFees = totalFees + uint64(fee);.

The maximum value for uint64 is 18446744073709551615 which is around 18.44 ether. This means that if fee which is uint256 is actually more than the upper limit of uint64, then it will be truncated and result in smaller fees being collected.

Since the only way to withdraw ether is to call withdrawFees(), plus the function is based on totalFees, then the truncated part will be forever lost in the contract.

Impact

Fees collected will be smaller than expected for the protocol, and the fees lost will be forever stuck in the contract.

Tools Used

Manual Review.

Recommendations

Don't do the type cast. This isn't needed.