First Flight #2: Puppy Raffle

Summary

SelectWinner function checks the length of the players array to calculate the prizePool and the fees.
Refund function refunds the amount user paid when entering and sets user index to address(0) but this does not change the length of the players array.

Therefore even though the contract paid back the amount, still delivers that amount in the prize pool.

When the selectWinner is called, if the prizePool is larger than the contract balance, the contract is stuck.

Impact

Malicious users can enter and refund multiple times to break the system.

Recommendations

Remove refunded user from the players array instead of setting it to address(0)

    players[index] = players[payees.length - 1];
    players.pop();