Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

First-Time ETH Claim Abuse via Wallet Cycling

ekram5

Root + Impact

Description

  • First-time users receive 0.005 Sepolia ETH.(The faucet sends 0.005 Sepolia ETH to first-time users. This is determined by checking hasClaimedEth[msg.sender].)

  • Users can repeatedly claim ETH by cycling through new wallets.(Since msg.sender can be changed by using new wallets, users can repeatedly claim ETH by cycling through fresh addresses.)

if (!hasClaimedEth[msg.sender]) {
payable(msg.sender).transfer(0.005 ether);
hasClaimedEth[msg.sender] = true;
}
​

Risk

Likelihood:

  • Any time a user interacts with the faucet using a fresh wallet.

  • There’s no identity verification beyond wallet address

  • This occurs whenever a user interacts with the faucet using a new wallet address. Since wallet creation is free and fast, the barrier to abuse is low.

Impact:

  • ETH reserves can be drained, disrupting faucet functionality

  • Faucet loses reliability as a testing tool

  • Reduced availability for real testers

  • Loss of trust in faucet reliability

Proof of Concept

// Simulate multiple wallet claims
for (uint i = 0; i < 10; i++) {
address newWallet = createNewWallet();
faucet.claimFaucetTokens({from: newWallet});
}
​

Explanation:

This loop simulates a user creating multiple wallets to repeatedly claim ETH. Each wallet bypasses the hasClaimedEth check, exploiting the faucet.

Recommended Mitigation

Explanation:

Introduce a verification layer (e.g., Merkle proof, off-chain KYC, or allowlisting)

Alternatively, limit ETH claims to trusted addresses or use a one-time claim token

Emit events for ETH claims to improve traceability

- if (!hasClaimedEth[msg.sender]) {
+ if (!hasClaimedEth[msg.sender] && isHumanUser(msg.sender)) {
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.