Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Broken Token Burning Mechanism

xylem56

Description:

The burnFaucetTokens() function contains severe logical errors that make it completely non-functional and dangerous. The function attempts to transfer the entire contract balance to the owner regardless of the specified burn amount, then tries to burn tokens from the owner's balance. This creates multiple issues including incorrect token accounting and potential transaction failures.

Impact:

  • Complete Contract Drainage: Calling burnFaucetTokens with any amount transfers ALL tokens to owner

  • Token Accounting Corruption: Burns incorrect amounts leading to supply inconsistencies

  • Transaction Failures: May revert due to insufficient owner balance for burning

  • Loss of User Funds: All tokens intended for faucet distribution are transferred to owner

Proof of Concept:

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
// Vuln: Transfers ENTIRE balance, not amountToBurn
_transfer(address(this), msg.sender, balanceOf(address(this)));
// Now owner has entire balance, contract has 0
​
// Vuln: Tries to burn from owner, but amountToBurn might be different from transferred amount
_burn(msg.sender, amountToBurn);
// This will fail if owner doesn't have enough tokens (which they might not)
}
​
// Example exploitation:
// Contract has 1,000,000 tokens
// Owner calls burnFaucetTokens(1000)
// Result: 1,000,000 tokens transferred to owner, then tries to burn 1000 from owner
// If owner had 0 tokens initially, the burn fails but transfer already happened

Recommended Mitigation:

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn > 0, "Amount must be positive");
require(amountToBurn <= balanceOf(address(this)), "Insufficient contract balance");
// Burn directly from contract address
_burn(address(this), amountToBurn);
emit TokensBurned(amountToBurn);
}
​
// Alternative: If you need to transfer to owner first (for some reason)
function withdrawAndBurnTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn > 0, "Amount must be positive");
require(amountToBurn <= balanceOf(address(this)), "Insufficient contract balance");
// Transfer specific amount to owner
_transfer(address(this), msg.sender, amountToBurn);
// Burn from owner
_burn(msg.sender, amountToBurn);
emit TokensBurned(amountToBurn);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.