First Flight #2: Puppy Raffle

Summary

refund() function is vulnerable to a reentrancy attack.

Vulnerability Details

The function does not follow the pattern "Checks, Effects, Interactions" and that leaves the contract vulnerable to reentrancy attack.

Impact

A malicious contract could register its address as a player, after that call the 'refund' function with the index of that address and call the refund function again with the same index in its 'receive' function thus draining the funds of the contract.

Tools Used

Manual review

Recommendations

Follow "Checks, Effects, Interactions" patterns. Even better remove the 'refund' function as it creates further issues as describe in my other finding.