First Flight #2: Puppy Raffle

Summary

By calling refund() a player can steal all the ether in the contract

Vulnerability Details

In refund() the value of a ticket is sent to the user before removing the player from the list. So in a receiver() or a fallback() on a malicious contract, an attacker can call this function again and again until all funds in the PuppyRaffle contract have been drawn

Impact

All contract ethers can be stolen

Tools Used

Manual review

Recommendations

Apply the Check-Effect-Interaction (CEI) pattern to refund()
Also apply the Oppenzepelin's nonReentrant modifier or a custom one