First Flight #2: Puppy Raffle

Summary

Because of uint64 overflow collected fee calculated can be incorrect that leads to money blockage on the contract

Vulnerability Details

In totalFees = totalFees + uint64(fee); if fee is greater than 2**64 or approximately 18.4 * 10**18, overflow occurred that will reset the totalFees variable. Overflow can happen if 18.5 / 20 * 100 or 92.5 ETH collected from participants. Variable totalFees is checked to be equal to contract balance, otherwise withdraw fails, require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");

Impact

If deployed more than 92.5 of the native network token is collected by participants, withdraw is blocked. This amount is pretty big on mainnet but if project is deployed to network like polygon where MATIC price is not high, this blocks the funds on the contract

Tools Used

Recommendations

Do not cast balance to uint64 variable