First Flight #2: Puppy Raffle

Summary

PuppyRaffle.sol::refund() function is vulnerable to reentrancy through sendValue()

Vulnerability Details

PuppyRaffle.sol::refund() function uses openzepplin Address.sol's sendValue() function to refund the calling player, Looking at the docs of this smart contract we see the following warning:

As refund() does not implement either of those techniques, it is vulnerable to rerentrancy attack.

Impact

A malicious player can use this vulnerability to drain the contract's balance.

Tools Used

manual review

Recommendations

Use -checks-effects-interactions pattern or OZ-ReentrancyGuard to mitigate this risk.
Also, Check the contract balance is > the refund before sending it to the player.