First Flight #2: Puppy Raffle

Summary

Use of strict equalities that can be easily manipulated by an attacker.

Vulnerability Details

Location:

PuppyRaffle.withdrawFees() (src/PuppyRaffle.sol#157-163) uses a dangerous strict equality:

• require(bool,string)(address(this).balance == uint256(totalFees),PuppyRaffle: There are currently players active!) (src/PuppyRaffle.sol#158)

Impact

If there's any mistake in the contract's balance management, it could lead to loss of funds.

Tools Used

Audit Wizard (Slither)

Recommendations

Don't use strict equality to determine if an account has enough Ether or tokens.