Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Unused State Variable `blockTime` in `RaiseBoxFaucet`

0xzhd

Root + Impact

Description

The blockTime variable is set to block.timestamp at deployment (e.g., 08:25 AM +06 on October 14, 2025) and remains static thereafter. While block.timestamp is used in claimFaucetTokens for daily resets and cooldown checks, blockTime is not referenced in any function, event, or logic within the contract. This suggests it may have been a remnant of a planned feature (e.g., contract age validation) that was abandoned or replaced with direct block.timestamp usage.

The unused variable bloats the contract's bytecode, increasing deployment costs and complicating code reviews as auditors must verify its irrelevance. This is a common issue in iterative development where code cleanup is neglected.

// @> Root cause in the codebase
uint256 public blockTime = block.timestamp; // @> Defined but unused

Risk

Likelihood:

  • High: Unused variables are a frequent byproduct of evolving codebases where planned features are dropped without removal.

  • Easily overlooked in contracts with multiple state variables.

Impact:

  • Low: Negligible runtime effect, with a minor gas overhead (~2000 gas at deployment).

  • Maintenance burden: Clutter may obscure critical logic or lead to accidental misuse in future updates.

Proof of Concept

The following Foundry test confirms that blockTime is unused and remains static, with no impact on contract behavior.

Add to RaiseBoxFaucetTest.t.sol:

Proof of Code
function testUnusedBlockTime() public {
// Arrange: Deploy contract
uint256 deployTimestamp = block.timestamp; // e.g., 08:25 AM +06, Oct 14, 2025
RaiseBoxFaucet faucet = new RaiseBoxFaucet("Test", "T", 1e18, 0.01 ether, 0.05 ether);
​
// Act & Assert: Check initial value and no usage
assertEq(faucet.blockTime(), deployTimestamp, "blockTime should match deploy timestamp");
console.log("Deploy timestamp:", deployTimestamp);
console.log("blockTime value:", faucet.blockTime());
​
// Simulate a claim – no blockTime reference
vm.prank(user1);
faucet.claimFaucetTokens(); // Uses block.timestamp, not blockTime
assertEq(faucet.blockTime(), deployTimestamp, "blockTime remains unchanged, unused");
}

Explanation

  • Setup: Deploys the contract, capturing the deployment timestamp (e.g., 08:25 AM +06, Oct 14, 2025).

  • Issue Demonstration: The test verifies blockTime holds the static deploy time and is not updated or referenced during a claim, confirming its unused status.

  • Result: The test passes, showing blockTime adds no value, with logs highlighting its static nature.

  • The assertion and logs prove the variable's redundancy, supporting the need for removal.

Recommended Mitigation

Remove the unused blockTime variable to reduce bytecode size and gas costs.

- uint256 public blockTime = block.timestamp;

  • It's current unused state, removal is the simplest and most effective solution.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.