Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Broken business logic in reseting limit breaks business rule

fredo182

Broken business logic in reseting limit breaks business rule

Description

A logic bug in claimFaucetTokens resets the contract's daily Sepolia-ETH drip counter (dailyDrips) when a returning (non-first-time) claimer calls the faucet. This allows the protocol to distribute more ETH than the intended daily cap to first-time claimers.

Risk

Likelihood: High

The limit is reset every time a non first time user claims faucet tokens.

Impact: Medium

The contract can exceed its intended daily ETH distribution, breaking the business rule that limits first-time ETH drips per day. The effect is loss of rate-limiting guarantees rather than immediate fund loss.

Proof of Concept

The following Forge test demonstrates that a recurring claim clears the daily counter and allows further first-time drips:

function test_recurring_claimer_resets_daily_drips() public {
vm.warp(5 days);
​
vm.startPrank(user1);
vm.expectEmit(true, true, false, false);
emit SepEthDripped(user1, sepEthDrip);
vm.expectEmit(true, true, false, false);
emit Claimed(user1, faucetDrip);
raiseBoxFaucet.claimFaucetTokens();
vm.stopPrank();
​
vm.warp(10 days);
​
address user2 = makeAddr("user2");
vm.startPrank(user2);
vm.expectEmit(true, true, false, false);
emit SepEthDripped(user2, sepEthDrip);
vm.expectEmit(true, true, false, false);
emit Claimed(user2, faucetDrip);
raiseBoxFaucet.claimFaucetTokens();
vm.stopPrank();
​
// Should not drip more ETH
assertEq(raiseBoxFaucet.dailySepEthCap(), 0.005 ether);
assertEq(raiseBoxFaucet.dailyDrips(), 0.005 ether);
​
// Recurring claimer resets daily drips
vm.startPrank(user1);
vm.expectEmit(true, true, false, false);
emit Claimed(user1, faucetDrip);
raiseBoxFaucet.claimFaucetTokens();
vm.stopPrank();
​
assertEq(raiseBoxFaucet.dailySepEthCap(), 0.005 ether);
assertEq(raiseBoxFaucet.dailyDrips(), 0 ether);
​
// New claimer can get drip again
address user3 = makeAddr("user3");
vm.startPrank(user3);
vm.expectEmit(true, true, false, false);
emit SepEthDripped(user3, sepEthDrip);
vm.expectEmit(true, true, false, false);
emit Claimed(user3, faucetDrip);
raiseBoxFaucet.claimFaucetTokens();
vm.stopPrank();
}

Recommended Mitigation

Remove the else statement in the RaiseBoxFaucet::claimFaucetTokens function

-} else {
- dailyDrips = 0;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyDrips Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.