First Flight #2: Puppy Raffle

Summary

I have found 5 issues, they are described in the Findings.md file. The code is updated accordingly.

I'm sure there are some more issues to find, but this is literally my first fight since I started to learn Solidity from scratch, having 0 experience in programming. I tried to set up some invariant tests as well, but still learning and working on it. By the way thanks to these challenges, it is a good practical experience to dive deeper and understand how things work.

Vulnerability Details

Briefly, the issues I have found are:

1. Change the array players to the mapping to save gas.

2. It should not be possible to add an array newPlayers that consists of zero addresses.

3. A reentrancy attack is possible in the base code version, the index should be set to 0 before the transfer, line 110. The code for the attack is ReentrancyRaffle.sol. // high impact

4. The winner must have a valid ID in the players array

5. 5. Since the function withdrawFees() is set to be called manually, it is possible to manually create conditions when the owner can never get the fees.

Impact

high/ medium/ low

Tools Used

manual review

Recommendations

are in the file Findings.md, the code changed accordingly