First Flight #2: Puppy Raffle

Summary

The downcast from uint256 to uint64 will lead to the incorrect calculation of ethers transfer, which might lead to token locked in the contract.

Vulnerability Details

In the selectWinner function, the totalFees is uint64 type while the fee downcast from uint256 to uint64, this will lead to the incorrect calculation to transfer ether.

Impact

Consider the calculation of fee in selectWinner function, originally the totalFee value is zero, and the fee value is 100 ether. After the operation of totalFees = totalFees + uint64(fee); , the downcast decrease the totalFee from 100,000,000,000,000,000,000 wei to 7,766,279,631,452,241,920 wei. The proof of concept is shown in this gist：https://gist.github.com/LouisTsai-Csie/367564bf00471a85a49b00b8f4fc6b29

Tools Used

manual review and foundry test

Recommendations

Use uint256 consistently