First Flight #2: Puppy Raffle

Summary

After the refund function has been called, the index of the player that called the refund is pegged to address (0) which is possible to be selected as the winner too. This will result in the game throwing error sometimes.

Vulnerability Details

players[playerIndex] = address(0); this will add address(0) to the players and cause error. Therefore, it is better to delete the refunded player and make the contract request a new player be added.

Impact

the select winner function may continuously throw error if the players are less than 4 due to refund which will also affect the poolprize calculation

Tools Used

manual review
remixIde

Recommendations