First Flight #2: Puppy Raffle

Vulnerability Details

The withdrawFees function does not have any access control mechanism in place. This means that any address can call this function, while the function is designed to send the fees to the feeAddress, regardless of who calls the function, the lack of access control could still lead to unnecessary or malicious calls to the function, which could waste gas or potentially exploit other vulnerabilities

Impact

Even if an unauthorized user calls the function, they cannot redirect the fees to themselves. However, the lack of access control could still lead to unnecessary or malicious calls to the function.

Tools Used

Manual Review

Recommendations

Add a require statement at the beginning of the withdrawFees function to check if msg.sender is the feeAddress: