First Flight #2: Puppy Raffle

Summary

The function selectWinner() does not have any safemath operation used. The contract version being used is 0.7.6, which means that there is still no native check for overflow/underflow.

Vulnerability Details

The value totalFees could potentially be overflowed if it ever hits max value and incremented, and reset back to 0.

Impact

The actual value of the fee would be misrepresented, losing the fee amount and rendering it unwithdrawable.

Tools Used

Manual review.

Recommendations

• It is reccomended to use SafeMath math functions such as add() instead of plus (+) operation.