First Flight #2: Puppy Raffle

Summary

The vulnerability in the selectWinner function arises from the use of the _safeMint function without proper reentrancy protection. _safeMint makes an external call to onERC721Received in the recipient contract, which can be exploited by malicious contracts for reentrancy attacks.

Vulnerability Details

The _safeMint function used to mint NFTs, involves making an external call to the onERC721Received function in the recipient contract. If the recipient contract is malicious, it can implement onERC721Received in a way that reenters the calling contract leading to reentrancy vulnerabilities. In this case, the selectWinner function is particularly vulnerable because it mints NFTs without any reentrancy protection.

Impact

Attacker could manipulate the prize distribution

Tools Used

Manual analysis

Recommendations

Implement Reentrancy Protection: