First Flight #2: Puppy Raffle

Summary

Using low level calls for transferring the balance may fail the transactions without reverting the function.

Vulnerability Details

Use of .sendValue() for transferring the refund entrance fee to the msg.sender can possible that the refund is not successfully to the caller address and the refund function is successfully executed.

Impact

    function refund(uint256 playerIndex) public {
    address playerAddress = players[playerIndex];
    require(playerAddress == msg.sender, "PuppyRaffle: Only the player can refund");
    require(playerAddress != address(0), "PuppyRaffle: Player already refunded, or is not active");

    payable(msg.sender).sendValue(entranceFee);

    players[playerIndex] = address(0);
    emit RaffleRefunded(playerAddress);
}  

Tools Used

manual check

Recommendations

Use a check after .sendValue for ensuring that either its successfully transfer or not.
{bool success ,} = payable(msg.sender).sendValue(entranceFee);
require(success);