First Flight #2: Puppy Raffle

Summary

A malicious contract can drain the puppy raffle contract through reentrancy in the refund() function.

Vulnerability Details

A malicious contract can deposit once as the entry fee and immediately call refund(). Then in the fallback, continue to call the refund function while the contract balance is still above or equal to the entrancyFee.

Since there is no reentrancy guard and since the raffle contract is not following CEI or FREI-PI pattern, the contract is vulnerable.

Impact

The contract can be drained of its ETH.

Tools Used

manual review

Recommendations

Add a reentrancy modifier like OpenZeppelin's nonReentrant and follow CEI or FREI-PI patterns to prevent reentrancy risk.