First Flight #2: Puppy Raffle

Summary

There is a chance where the totalAmountCollected might be computed grater than the contract balance.

Vulnerability Details

In function selectWinner at line 131
uint256 totalAmountCollected = players.length * entranceFee;
if the array length is not reduced in refund function after deleting the address of the player.

Impact

As the totalAmountCollected is calculated is based on the number of players. When some player already claimed refund and the number of the player is not reduced the totalAmountCollected will be higher than the contract balance, hence results in a denial of service.

Tools Used

Foundry
Git
Manual review

Recommendations

Reduce the array size after deleting the player in the refund function.