First Flight #2: Puppy Raffle

Summary

anyone can call the withdrawFees() function. The address the fees are sent to can only be changed by the owner, but the fees can be withdrawn to this address without the owners permission.

Vulnerability Details

withdrawFees() function is external and has no OnlyOwner modifier so can be called by anyone.

Impact

Medium risk as 'funds can be indirectly at risk'. If the owner no longer has access to the set 'feeAddress' and has not yet changed it to a new address they own, the withdrawFees() function can be called without their permission, withdrawing funds to that address they can no longer access - loss of funds.

Tools Used

Recommendations

add the onlyOwner modifier to the withdrawFees() function.