Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Daily ETH Cap Bypass Due to Incorrect Reset Logic

minionteechs

Root + Impact

Description

Expected Behavior: Daily Drips should only reset once every 24 hours (or per calendar day) to ensure that the daily ETH distribution cap remains consistent.

Actual Behavior: DailyDrips resets during any user’s claim call even within the same day which unintentionally refreshes the ETH limit and allows multiple users to drain more ETH than intended.

// Root cause in the codebase with @> marks to highlight the relevant section
else {
@> dailyDrips = 0;
}

Risk

Likelihood

High: triggered automatically during legitimate user claims.

Impact

1.Unbounded daily ETH distribution

2.Rate-limiting logic becomes ineffective

3. Potential faucet exhaustion in one day

Proof of Concept

Explanation

Multiple users interacting within the same block can continually reset the counter, letting the faucet exceed its intended ETH limit before day rollover.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
​
import "forge-std/Test.sol";
import "../src/RaiseBoxFaucet.sol";
​
contract DailyEthCapBypassTest is Test {
RaiseBoxFaucet faucet;
address user1 = address(0x111);
address user2 = address(0x222);
​
function setUp() public {
faucet = new RaiseBoxFaucet("RaiseBox", "RBT", 1000 ether, 0.005 ether, 0.01 ether);
vm.deal(address(faucet), 1 ether);
}
​
function test_BypassDailyCap() public {
vm.startPrank(user1);
faucet.claimFaucetTokens(); // first ETH drip
vm.stopPrank();
​
vm.startPrank(user2);
faucet.claimFaucetTokens(); // resets dailyDrips = 0 mid-day
faucet.claimFaucetTokens(); // bypasses ETH cap
}
}

Recommended Mitigation

Reset dailyDrips only during valid new-day rollovers:

- remove this code
+ add this code
- else {
- dailyDrips = 0;
- }
​
+ uint256 currentDay = block.timestamp / 1 days;
+ if (currentDay > lastDripDay) {
+ lastDripDay = currentDay;
+ dailyDrips = 0;
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyDrips Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.