First Flight #2: Puppy Raffle

Summary

Winner could be address(0)

Vulnerability Details

the winner is selected in the following manner and check if the selected address is address(0) is missing:

address winner = players[winnerIndex];

Further down the function some funds are sent to the winner which could be address(0)
(bool success,) = winner.call{value: prizePool}("");

Impact

Invalid winner could be selected.

Tools Used

Manual review

Recommendations

Do not allow address(0) values to be left in the 'players' array (remove 'refund' function).