First Flight #2: Puppy Raffle

Summary

The 'refund' function is susceptible to a re-entrancy attack..

Vulnerability Details

Inside the 'refund' function the state change happens after the funds have been withdrawn which makes the function vulnerable to a re-entrancy attack.
The function refunds the entrance fee before it changes the state.
This makes it possible for malicious actors to exploit this function using a simple attack contract.

Impact

A critical impact due to the nature of this attack.
It is possible to drain the whole entrance fee pool with a few lines of code.

Tools Used

Vs Code
Foundry

Recommendations

Always follow the 'Checks-Effects-Interactions pattern'.
This helps to prevent attacks like this as a basic precaution.
Nowadays we can also simply use the openzeppelin reentrancyguard to prevent these kind of attacks.