First Flight #2: Puppy Raffle

Summary

The PuppyRaffle::selectWinner function does not have any access control so any user can call it.
Attacker can exploit this and call the function when it is most advantageous for them.
For example when most of the participants in the current raffle are accounts owned by the attacker.

Vulnerability Details

Impact

Tools Used

Recommendations

Modify PuppyRaffle::selectWinner so only the owner can call it.

As best practice, it would be best if the same was done on PuppyRaffle::withdrawFees function. Currently, lack of access control on this function doesn't present any security risk but there is no reason this function should be called by anyone other than the owner.