First Flight #2: Puppy Raffle

Summary

Unprotected call to a function sending Ether to an arbitrary address.

Vulnerability Details

Location:

PuppyRaffle.withdrawFees() (src/PuppyRaffle.sol#157-163) sends eth to arbitrary user
Dangerous calls:

• (success) = feeAddress.call{value: feesToWithdraw}() (src/PuppyRaffle.sol#161)

Impact

The withdrawFees function allows to withdraw all the balance of the contract. If there's any mistake in the contract's balance management, it could lead to loss of funds.

Tools Used

Audit Wizard (Slither)

Recommendations

Ensure that an arbitrary user cannot withdraw unauthorized funds.