First Flight #2: Puppy Raffle

Summary

Using sendValue to send ETH can lead to Reentrancy in the function refund(...).

Vulnerability Details

In the function refund(...), OZ function sendValue(...) is used to send the refund amount. The function sendValue(...) uses a low-level call, which can call this function again from the smart contract receiving the ETH, and as the protocol is not using the Check-Effect-Interaction pattern, will lead the to loss of all ETH in the contract.

Impact

• Loss of Funds

Tools Used

Manual Review

Recommendations

Using CEI Pattern when using Low-Level Call interactions with external contracts.