First Flight #2: Puppy Raffle

Summary

Protocol fees stored and processed is in uint64 instead of uint256.

Vulnerability Details

A part of the ETH sent to the contract as entrance fee is taken as a protocol fee. The fee is stored in a uint64 variable and also during calculation, is converted from uint256 to uint64 without enough checks. In certain cases (when the value of ETH sent is higher than 2 ** 64), the actual value could be truncated and a wrong value will be stored in the totalFee parameter.

Impact

Internal Accounting which can result in an unusable state for the protocol fee withdrawal.

Tools Used

Manual Review.

Recommendations

Using uint256 instead of uint64.