First Flight #2: Puppy Raffle

Summary

Require statement in withdrawFees() will lead to a DoS vulnerability.

Vulnerability Details

Any malicious user can DoS this call by sending 1 wei to this contract since the require statement relies on a strict equality between address(this).balance and totalFees.

Impact

The fee collector will be unable to collect its owed fees and leads to a financial loss for the project.

Tools Used

Manual review

Recommendations

Do not rely on address(this).balance being exactly the same as the accounted for fees. Better to use address(this).balance >= totalFees.