First Flight #2: Puppy Raffle

Summary

The refund() function in the PuppyRaffle contract is vulnerable to a reentrancy attack. This vulnerability could be exploited to steal all of the funds in the contract.

Vulnerability Details

The refund() function works as follows:

1. The player's address is retrieved from the players array at the specified index.

2. A require statement checks that the player address is equal to the caller's address.

3. Another require statement checks that the player address is not already refunded or is not active.

4. The player's entrance fee is sent back to them using the sendValue() function.

5. The player's address is set to address(0) in the players array.

6. A RaffleRefunded event is emitted.

The vulnerability is that the players array is updated after the sendValue() call is made. This means that if the attacker is able to reenter the refund function before the update to players mapping has completed, the attacker can steal all of the funds in the contract.

Proof of Concept

Impact

If this vulnerability is exploited, the attacker could steal all of the funds in the PuppyRaffle contract.

Tools Used

Foundry

Recommendations

Follows the CEI pattern and update the players mapping before the external call is being made