Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Revert on Exact Faucet Drip Balance

empyrean

Incorrect Revert on Exact Faucet Drip Balance

Description

claimFaucetTokens checks contract token balance against faucetDrip; if <=, reverts. When equal, transfer succeeds (balance to 0), but revert blocks valid claim.

//@> if the balance is = faucetDrip, should be allowed since balance can carry
if (balanceOf(address(this)) <= faucetDrip) {
revert RaiseBoxFaucet_InsufficientContractBalance();
}

Risk

Likelihood:

  • Contract balance hits exactly faucetDrip post-claims.

  • No minting between claims.

Impact:

  • Blocks legitimate claims, stranding users.

  • Wastes gas, frustrates usability.

Proof of Concept

function testClaimRevertsOnExactDripBalance() public {
uint256 drip = raiseBoxFaucet.faucetDrip(); // 1000e18
uint256 initialBalance = raiseBoxFaucet.getFaucetTotalSupply(); // 1e9 e18
​
// Burn whole and mint, to leave exactly drip
vm.prank(owner);
raiseBoxFaucet.burnFaucetTokens(initialBalance);
raiseBoxFaucet.mintFaucetTokens(address(raiseBoxFaucet), drip);
vm.stopPrank();
​
uint256 contractBalance = raiseBoxFaucet.balanceOf(address(raiseBoxFaucet));
assertEq(contractBalance, drip);
​
// Claim should succeed but reverts
vm.prank(user1);
vm.expectRevert(RaiseBoxFaucet.RaiseBoxFaucet_InsufficientContractBalance.selector);
raiseBoxFaucet.claimFaucetTokens();
​
// Post-revert, balance unchanged
assertEq(raiseBoxFaucet.balanceOf(user1), 0);
assertEq(raiseBoxFaucet.balanceOf(address(raiseBoxFaucet)), drip);
}

POC Explanation: Burns whole to mint exact faucetDrip balance. User1 claim reverts on <= check, despite transfer viable, leaving balance/user unchanged, proving false negative.

Recommended Mitigation

- if (balanceOf(address(this)) <= faucetDrip) {
- revert RaiseBoxFaucet_InsufficientContractBalance();
- }
+ if (balanceOf(address(this)) < faucetDrip) {
+ revert RaiseBoxFaucet_InsufficientContractBalance();
+ }

Mitigation Key Points: Change <= to <; allows exact transfer to 0. No new risks; aligns with ERC20 transfer semantics.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Off-by-one error in `claimFaucetTokens` prevents claiming when the balance is exactly equal to faucetDrip

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.