First Flight #2: Puppy Raffle

Summary

Sending native tokens can skew the validation of the withdrawFees() function

Vulnerability Details

The withdrawFees() function has the following validations.
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
Since address(this).balance can be changed by forcing ETH to be sent, this validation can always fail.
This makes withdrawFees() virtually impossible to invoke.

Impact

fee will not be able to collect.

Tools Used

Manual

Recommendations

Stop referring to address(this).balance. Prepare another variable to manage whether the game is active or not.