First Flight #2: Puppy Raffle

Summary

withdrawFees can be griefed

Vulnerability Details

A player can keep entering and exiting the raffle hence increasing and decreasing the balance of the contract and in turn negating the condition address(this).balance == uint256(totalFees). This will make it unable for the owner to withdraw fees.

Impact

Owner will not be able to withdraw fees.

Tools Used

Manual

Recommendations

• Never use address(this).balance as a means of comparison as it can be influenced by external users.

• Disallow players to call refund after raffleStartTime + raffleDuration and allow the owner or any user to call withdrawFees after raffleStartTime + raffleDuration.