First Flight #6: Voting Booth

Summary

_sendEth function does not protect against reentrancy attacks.

Vulnerability Details

If the destination address is a contract that implements a malicious fallback function, it could call back into the sending contract before the original call is finished (i.e., before the require statement is executed), potentially leading to unexpected behavior.

Impact

All Eth could be maliciously drained from the contract.

Tools Used

Recommendations

It's recommended to use established patterns for sending Ether, such as the withdrawal pattern, and to use tools like the OpenZeppelin contracts library that have been thoroughly reviewed and tested.