First Flight #2: Puppy Raffle

Summary

After calling refund, the player’s address becomes zero and he continues to participate in the lottery.

Vulnerability Details

After calling refund() the player's address becomes address(0) and he continues to participate in the lottery. If the player with address(0) wins, the money is sent to address zero and burned.

Impact

Money is sent to zero address and burns.

Tools Used

Manual review

Recommendations

After calling a refund(), need remove player from array. Replace players[playerIndex] = address(0); with delete players[playerIndex];.