First Flight #2: Puppy Raffle

Summary

Unprotected call to a function sending Ether to an arbitrary address.

Vulnerability Details

'''solidity
function withdrawFees() external {
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
@>(bool success,) = feeAddress.call{value: feesToWithdraw}("");
require(success, "PuppyRaffle: Failed to withdraw fees");
}
'''

Impact

unauthorized funds withdraw

Tools Used

-slither

• foundry

Recommendations

Ensure that an arbitrary user cannot withdraw unauthorized funds.