Summary

Fee Address can enter the raffle, which may lead to the it winning the raffle, getting all the fees (not 20%) and nft.

Vulnerability Details

function etnerRaffle(); doesn't check if any of the addresses are a fee address or not, which may result in the problem mentioned in Summary. All the funds are indirectly at risk, because the process of selecting a winner is still random, but it still can be feeAddress, and the team may select a lower duration, so there are less players, thus higher chance of feeAddress winning
here is the test:
function testCanEnterRaffle() public {
address[] memory players = new address;
players[0] = feeAddress;
puppyRaffle.enterRaffle{value: entranceFee}(players);
assertEq(puppyRaffle.players(0), feeAddress);
}

Impact

impact is medium, because the funds are indirectly at risk. The protocol cannot drain it all the way, but they still can get all the money from raffles

Tools Used

Foundry

Recommendations

In function enterRaffle, in for-loop of pushing address to players array, add a check for feeAddress: