First Flight #2: Puppy Raffle

Summary

The prize pool is send to the winner, so the success of the PuppyRaffle::selectWinner function depends on the winner fallback function.

Vulnerability Details

The winner can revert or provoke a DoS attack on his fallback.

Impact

This vulnerability does not result on funds being drained but affects the functionality of the contract and its reliability

Tools Used

Foundry

Recommendations

My recommendation is to always avoid external dependencies. Instead of sending the Prize Pool, a withdraw pattern should be implemented. In that way the protocol is quite robust and invulnerable.