First Flight #2: Puppy Raffle

Summary

Use of strict equalities that can be easily manipulated by an attacker.

Vulnerability Details

'''solidity
function withdrawFees() external {
@> require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
(bool success,) = feeAddress.call{value: feesToWithdraw}("");
require(success, "PuppyRaffle: Failed to withdraw fees");
}
'''

Impact

withdrawing fees

Tools Used

-slither

• foundry

Recommendations

Don't use strict equality to determine if an account has enough Ether or tokens.