First Flight #2: Puppy Raffle

Summary

Strict equality check of the smart contract balance to the totalFees collected in withdrawFees() makes it vunerable to an unexpected ether attack

Vulnerability Details

If a user manually sends ether at this PuppleRaffle by calling selfDestruct on another contract, this messes the account of the fees collected in comparison to the current balance of the smart contract. Then making the collected fees impossible to withdraw from the protocol.

Impact

Collected fees can be impossible to withdraw

Tools Used

Manual review

Recommendations

Instead of that strict check, check if players' array is used by an active raffle.