First Flight #2: Puppy Raffle

Summary

Vulnerability Details

the require statement in this function can expose the contract to a DOS attack of the withdrawFee function.
'''
function withdrawFees() external {
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
'''

say if someone selfdistruct into the contract, the require statement wont be valid anymore and calling withdrawFee function will keep throwing error. This will allow the contract to keep accruing the fee till someone exploit the reentrancy in the refund function and wipe off the contract fund entirely. note that changing feeAddress wont solve this problem.

Impact

the fee from the games continues being in the contract forever or till the contract get exploited through the vulnerable refund function.

Tools Used

remix

Recommendations

modify this statemente
'''
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
'''