Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

DOS in claim faucet token when daily limit is reached once

fredo182

DOS in claim faucet token when daily limit is reached once

Description

A logic issue prevents further claims after the daily claim limit is hit once. The contract’s daily claim counter is not correctly time-bounded, so after the limit is reached any subsequent claims are rejected indefinitely until manual intervention by the owner.

Risk

Likelihood: High

The condition triggers whenever the daily limit is exhausted.

Impact: High

The faucet becomes unavailable to all users (denial-of-service) until an admin resets the counter or adjusts the limit.

Proof of Concept

The following Forge test demonstrates that once the limit is reduced to 1 and a claim is made, a later user is permanently blocked until admin action:

function test_dos_once_daily_limit_reached() public {
vm.startPrank(owner);
uint256 initialDailyClaimLimit = raiseBoxFaucet.dailyClaimLimit();
raiseBoxFaucet.adjustDailyClaimLimit(initialDailyClaimLimit - 1, false);
uint256 endingDailyClaimLimit = raiseBoxFaucet.dailyClaimLimit();
vm.stopPrank();
assertEq(initialDailyClaimLimit, 100);
assertEq(endingDailyClaimLimit, 1);
​
vm.warp(5 days);
​
vm.startPrank(user1);
vm.expectEmit(true, true, false, false);
emit SepEthDripped(user1, sepEthDrip);
vm.expectEmit(true, true, false, false);
emit Claimed(user1, faucetDrip);
raiseBoxFaucet.claimFaucetTokens();
vm.stopPrank();
​
bool hasClaimedEth = raiseBoxFaucet.getHasClaimedEth(user1);
uint256 dailyClaimCount = raiseBoxFaucet.dailyClaimCount();
uint256 dailyDrips = raiseBoxFaucet.dailyDrips();
uint256 lastDripDay = raiseBoxFaucet.lastDripDay();
uint256 lastFaucetDripDay = raiseBoxFaucet.lastFaucetDripDay();
​
assertTrue(hasClaimedEth);
assertEq(dailyClaimCount, 1);
assertEq(dailyDrips, sepEthDrip * 1);
assertEq(lastDripDay, 5);
assertEq(lastFaucetDripDay, 5 days);
​
vm.warp(6 days + 1 hours);
​
address user2 = makeAddr("user2");
vm.startPrank(user2);
vm.expectRevert();
raiseBoxFaucet.claimFaucetTokens();
vm.stopPrank();
}

Recommended Mitigation

Enforce a time-bound check so the daily counter only blocks claims within the same day window. Example patch:

-if (dailyClaimCount >= dailyClaimLimit) {
+if (dailyClaimCount >= dailyClaimLimit && block.timestamp < lastFaucetDripDay + 1 days) {
revert RaiseBoxFaucet_DailyClaimLimitReached();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyClaimCount Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.