First Flight #2: Puppy Raffle

Summary

The value of the totalFees goes through unsafe casting from 'uint256' to 'uint64'.

Vulnerability Details

In the selectWinner() function, 'fee' is unsafely casted from 'uint256' to 'uint64'. This makes it possible for the amount to be recorded to be lower than the actual amount expected.

For example.

If the value of fee is larger than 2 ** 64 - 1 then the unsafe cast will only keep the rightmost bits, which in turn will result in a value much smaller than defined in uint256 fee.

Impact

Loss of funds for the totalFees.

Tools Used

Manual Review.

Recommendations

• totalFees should be stored as uint256.

• Could also use the OpenZeppelin's SafeCast library, when casting from uint256 to uint64.