First Flight #2: Puppy Raffle

Summary

The value of totalFees variable will be reduced when large number of participants enter the raffle, as an overflow occurs as a result of typecasting the fee variable to uint64.

Vulnerability Details

In the selectWinner function the value of totalFees variable will be set to a much lower value if a large number of participants (approx near to 100 players) enter the raffle causing the typecasting of the fee to overflow.

Impact

Less fess transfered to the fee addresss.

Poc

function testSelectWinnerSetWrongFeesWhenPlayersAreMore() public {

    uint256 playersNum = 100;
    address[] memory players = new address[](playersNum);

    // Enter 100 players
    for (uint i = 0; i < playersNum; i++) {
        players[i] = address(i);
    }
    puppyRaffle.enterRaffle{value:entranceFee * playersNum}(players);
    vm.warp(block.timestamp + duration + 1);
    vm.roll(block.number + 1);
    puppyRaffle.selectWinner();
    uint totalFees = 0;
    uint256 totalAmountCollected = players.length * entranceFee;
    uint256 fee = (totalAmountCollected * 20) / 100;
    totalFees = totalFees + fee;
    console.log("Totalfee is : ",puppyRaffle.totalFees());
    console.log("Totalfee should be : ",totalFees);
    assert(puppyRaffle.totalFees()!=totalFees);
}

Tools Used

VS Code

Recommendations

Use solidity version above 0.8.0 or use SafeMath.