First Flight #2: Puppy Raffle

Summary

the refund function is vulnerable to reentrancy attack

Vulnerability Details

reentrancy attack can happen because the interaction is before the effect of zeroing
out the player's array entry.

Impact

Reentrancy attack can occur if someone calls the function multiple times before the first call is done sending the refund. Someone could use this to get multiple refunds and drain the contract.

Tools Used

VSCode

Recommendations

should zero out the player's array entry before sending the value to the player.