First Flight #2: Puppy Raffle

Summary

totalFees has an overflow issue which can brick the withdrawFees function.

Vulnerability Details

In the selectWinner function, totalFees variable is updated with the new fees collected during the raffle round. However, the casting down from uint256 to uint64 can lead to overflow and thus lead to an incorrect amount of totalFees being calculated and totalFees value being out of sync with address(this).balance.

This would also mean that the calculation mistake will make the totalFees amount stuck in the contract forever.

Impact

The owner might not be able to withdraw fees.

Tools Used

Manual

Recommendations

Use uint256 for totalFees