First Flight #2: Puppy Raffle

Summary

Useless requirement in withdrawFees()

Vulnerability Details

Fees can be withdrawn only after successful check : ' require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");'

'totalFees' is a value that only increases and is brought to 0 after a successful fees withdrawal while the contract's balance could be any amount and also 0 as there are ways to drain the contract out of its funds(reported in another finding).

Impact

It may not be possible to transfer collected fees ever.

Tools Used

Manual review

Recommendations

First make sure the economics of the contract is OK. Then remove that requirement.