First Flight #2: Puppy Raffle

Summary

Refund allows for Reentrancy Attacks. All funds can be drained.

Vulnerability Details

The function refund() breaks the Checks Effects Interactions pattern by first sending the refund and only afterwards setting the player at playerIndex to address(0). A malicious user can implement a smart contract with a fallback that immediately calls refund after receiving a refund from the raffle, thus draining all funds like the 2016 DAO hack.

Impact

High. All funds can be drained through a reentrancy loop.

Tools Used

n/a

Recommendations

Use OpenZeppelin's ReentrancyGuard modifier or swap lines 101 and 103, zeroing the participant address before paying him. This would follow the Checks Effects Interactions pattern and protect the funds.