Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Hardcoded Faucet Token Mint Restriction Blocks Legitimate Refill

minionteechs

Root + Impact

Description

Expected Behavior:The faucet owner should be able to mint tokens whenever needed to maintain continuous claim availability.

Actual Behavior: Minting reverts if the faucet’s token balance exceeds 1000, even if nearly all tokens are about to be claimed.


Description

A hardcoded check prevents minting when the faucet already holds over 1000 tokens, making top-ups impossible even if tokens are nearly depleted by claimers.

// Root cause in the codebase with @> marks to highlight the relevant section
if (balanceOf(address(to)) > 1000 * 10 ** 18) {
@> revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}

Risk

Likelihood

High: Deterministic behavior affecting faucet reliability.

Impact

1.Owner lockout from refilling faucet

2. Token supply inconsistency

3. Downtime for faucet users

Proof of Concept

Explanation

The faucet uses a fixed balance threshold instead of checking whether claimable tokens are running low.

// Faucet holds 2000 tokens
faucet.mintFaucetTokens(address(faucet), 10_000 ether);
// ❌ Reverts: RaiseBoxFaucet_FaucetNotOutOfTokens()

Recommended Mitigation

Explanation: Replace hardcoded threshold with dynamic check

- remove this code
+ add this code
- if (balanceOf(address(to)) > 1000 * 10 ** 18) {
​
- revert RaiseBoxFaucet_FaucetNotOutOfTokens();
​
- }
​
​
​
+ uint256 minFaucetBalance = 1000 * 10 ** 18; // can be configurable
​
+ if (balanceOf(address(this)) >= minFaucetBalance) {
​
+ revert RaiseBoxFaucet_FaucetNotOutOfTokens();
​
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Validated
Assigned finding tags:

mintFaucetTokens is unusable due to logic/design mismatch with initial supply

Appeal created

inallhonesty Lead Judge
6 days ago
inallhonesty Lead Judge 6 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.