Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Broken business logic in burn faucet tokens leaves contract without token balace

fredo182

Broken business logic in burn faucet tokens leaves contract without token balace

Description

The protocol allows the owner to burn an amount of tokens, however, during the flow it moves the whole protocol balance to the owner.
When the amount to burn is a subset of the total balance, the protocol is left without funds to distribute to users.

Risk

Likelihood: High

The issue occurs every time the owner burns an amount.

Impact: Medium

The protocol transfers the funds to the admin account so funds are recoverable, however, users will experience service unavailable until it is noticed.

Proof of Concept

The following test proves the issue:

function test_can_burn_subset_of_balance() public {
vm.startPrank(owner);
uint256 contractStartingBalance = raiseBoxFaucet.balanceOf(contractAddress);
uint256 ownerStartingBalance = raiseBoxFaucet.balanceOf(owner);
uint256 amountToBurn = contractStartingBalance / 2;
raiseBoxFaucet.burnFaucetTokens(amountToBurn);
uint256 contractEndingBalance = raiseBoxFaucet.balanceOf(contractAddress);
uint256 ownerEndingBalance = raiseBoxFaucet.balanceOf(owner);
vm.stopPrank();
​
assertEq(contractEndingBalance, 0);
assertEq(ownerStartingBalance, 0);
assertEq(ownerEndingBalance, contractStartingBalance - amountToBurn);
}

The scenario tries to burn half of the contracts balance with the rest remaining in the contract, however, the requested amount is burned and the rest are transferred to the owner.

Recommended Mitigation

- _transfer(address(this), msg.sender, balanceOf(address(this)));
+ _transfer(address(this), msg.sender, amountToBurn);

It is recommended to transfer the amount to burn instead of the whole amount.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.