Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Token Burn Logic in `RaiseBoxFaucet` Contract

player

Description:

The burnFaucetTokens function is intended to allow the owner to burn a specified amountToBurn of tokens from the RaiseBoxFaucet protocol. This process occurs in two steps:

  1. The contract transfers tokens to the owner.

  2. The protocol subsequently burns the specified amount of tokens.

However, the current implementation transfers the entire token balance from the contract to the owner, rather than transferring only the specified amountToBurn. As a result, the protocol ends up burning only amountToBurn tokens while transferring the full balance to the owner, creating an inconsistency between the intended and actual behavior.

@> _transfer(address(this), msg.sender, balanceOf(address(this)));

Risk

Likelihood:

  • Reason 1: It will occur every time the owner tries to burn tokens

Impact:

This flawed mechanism causes the contract to send the entire token balance to the owner whenever a burn operation is executed. Consequently, it may disrupt the normal functioning of the protocol, potentially leading to unintended token distribution and undermining trust in the system’s integrity.

Proof of Concept

paste this code snippet in RaiseBoxFaucet.t.sol and run forge test --mt test_burnFaucetTokensMisStep -vvvv in the terminal

function test_burnFaucetTokensMisStep() public{
vm.prank(owner);
raiseBoxFaucet.burnFaucetTokens(INITIAL_SUPPLY_MINTED);
​
assertTrue(
raiseBoxFaucet.getFaucetTotalSupply() == 0,
"Token Burn: Supply should be zero"
);
​
vm.prank(owner);
raiseBoxFaucet.mintFaucetTokens(
raiseBoxFaucetContractAddress,
INITIAL_SUPPLY_MINTED
);
raiseBoxFaucet.getFaucetTotalSupply();
​
uint256 burnAmount=34;
vm.prank(owner);
raiseBoxFaucet.burnFaucetTokens(burnAmount);
​
assertTrue(
raiseBoxFaucet.getFaucetTotalSupply() == 0,
"Token Burn: Supply should notbe zero"
);
uint256 remainingAmount= INITIAL_SUPPLY_MINTED-burnAmount;
assertFalse(
raiseBoxFaucet.getFaucetTotalSupply() == remainingAmount
);
​
}

Recommended Mitigation

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
// Transfer only the specified amount before burning
- _transfer(address(this), msg.sender, balanceOf(address(this)));
+ _transfer(address(this), msg.sender, amountToBurn);
}
​

This change ensures that only the designated amount is transferred to the owner, maintaining the intended burn logic and preserving the integrity of the protocol’s token management.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.