First Flight #2: Puppy Raffle

Summary

It's possible to reenter selectWinner() function when the NFT is minted, thus draining any of the fees stored and possibly minting more than one token.

Vulnerability Details

If the caller of selectWinner() is a contract, it can be used to reenter the function. If the contract implements the onERC721Received function that _safeMint() is checking for, then it can re-enter the contract and if there are enough funds, it can get paid more and mint more than on token. Because it needs the contract to have enough funds and the admin not to withdraw, then this is not as likely to happen so marking as medium.

Impact

Medium

Tools Used

Manual review

Recommendations

Add a non-reentrant modifier to the function to ensure this behavior is not possible.