First Flight #2: Puppy Raffle

Summary

TotalFees accumulation can overflow

Vulnerability Details

The contract has the possibility of being compiled with a version less than 0.8.0, and versions less than 0.8.0 are not overflow/underflow protected. Additionally, the variable uint64 Totalfees can only take in a maximum of uint64, and it is possible for the total fee accumulated to be more than the maximum which is 18446744073709551615
(more than 18 ether ). If this is the case, the total fee will overflow, and the owner will not be able to withdraw the valid fee that has been accumulated from all rounds of the game

Impact

1. The owner of the contract may not be able to withdraw the valid fee that has been accumulated.

2. Users may lose money if the contract overflows due to excess withdraw by owner.

Tools Used

manual review

resources OWASP: https://owasp.org/www-project-smart-contract-top-10/2023/en/src/SC02-integer-overflow-underflow.html

Recommendations

1. The contract should be compiled with version 0.8.0 or higher.

2. The variable uint64 Totalfees should be changed to a larger type, such as uint128 or uint256.