First Flight #2: Puppy Raffle

Summary

Users can refund after the raffle is over.

Vulnerability Details

The refund function does not check if a raffle is over, whether before or after the winner gets picked, and allows a refund at any moment.

Impact

High. It means people can refund if they know they didn't win a raffle, before selectWinner is called.

Tools Used

n/a

Recommendations

Add a require(block.timestamp < raffleStartTime + raffleDuration, "PuppyRaffle: Raffle is over"); at the top of refund() to prevent users from refunding after the raffle is over.