Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Use of Magic Number in `RaiseBoxFaucet::mintFaucetTokens`

0xzhd

Root + Impact

Description

The mintFaucetTokens function in the RaiseBoxFaucet contract restricts minting new tokens if the contract's balance exceeds 1000 * 10 ** 18. This hard-coded value, known as a magic number, lacks context and makes it difficult for developers or auditors to understand its significance without additional documentation.

Using a named constant instead of a magic number improves code clarity, reduces the risk of errors during maintenance, and aligns with Solidity best practices.

// @> Root cause in the codebase
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
if (to != address(this)) {
revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
}
// @> Magic number used here
if (balanceOf(address(to)) > 1000 * 10 ** 18) {
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
_mint(to, amount);
emit MintedNewFaucetTokens(to, amount);
}

Risk

Likelihood:

  • Developers misinterpret the purpose of 1000 * 10 ** 18 during code reviews or updates due to lack of context.

  • Future modifications to the threshold value require manual changes to the hard-coded number, increasing the risk of errors.

Impact:

  • Reduced code readability makes it harder for auditors and developers to verify the logic of the minting restriction.

  • Maintenance errors, such as incorrectly updating the threshold value, could lead to unintended behavior in the faucet system.

Proof of Concept

The following example shows how the magic number affects readability and maintainability:

// Current implementation
if (balanceOf(address(to)) > 1000 * 10 ** 18) { // Unclear what 1000 * 10 ** 18 represents
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
​
// Proposed implementation
uint256 public constant MAX_FAUCET_BALANCE = 1000 * 1e18; // Clear and descriptive
if (balanceOf(address(to)) > MAX_FAUCET_BALANCE) {
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}

Recommended Mitigation

Define a named constant for the balance threshold and replace the magic number with it. Additionally, consider using scientific notation for better readability.

+ uint256 public constant MAX_FAUCET_BALANCE = 1000e18; // 1000 tokens with 18 decimals
.
.
.
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
if (to != address(this)) {
revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
}
- if (balanceOf(address(to)) > 1000 * 10 ** 18) {
+ if (balanceOf(address(to)) > MAX_FAUCET_BALANCE) {
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
_mint(to, amount);
emit MintedNewFaucetTokens(to, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.