First Flight #2: Puppy Raffle

Summary

Vulnerability Details

The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1).

POC

In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow.

Impact

This could consequently lead to inaccuracies in the computation of 'totalFees'.

Tools Used

Manual

Recommendations

To resolve this issue, you should change the data type of totalFees from uint64 to uint256. This will prevent any potential overflow issues, as uint256 can accommodate much larger numbers than uint64. Here's how you can do it:

Change the declaration of totalFees from:

to:

And update the line where totalFees is updated from:

This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.