First Flight #2: Puppy Raffle

Summary

LOW-6: The withdrawFees function is marked as external with no restrictions on the caller.

Vulnerability Details

Violation of the "minimum access" policy. The owner may want to change the withdrawal address before calling the function but may be unable to do so if another user calls the function before that.

Impact

Possibility to restrict the access to functions that should be callable only by the deployer

Tools Used

Static analysis

Recommendations

Mark the withdrawFees function as onlyOwner to grant only the owner the right to call the "withdrawFunds" function