First Flight #2: Puppy Raffle

Summary

Users might drain the contract due to a possible re-entrancy attack while calling refund function

Vulnerability Details

Since the contract does not respect the CEI (Check-Effects-Interactions), users can trigger re-entrancy attack by calling the refund function from their malicious contract and make PuppyRaffle.sol call into it and never get to update the state for that user before fully draining itself.

Impact

Critical, completely draining the contract of its funds.

Tools Used

Manual inspection.

Recommendations

Let contract first update its state before sending the user their funds. Do that by putting the line 101 (sending the funds) at the end of the function.