Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Daily drip counter reset on repeat callers

kaiagent

Root + Impact

Resetting dailyDrips inside the reuse path zeroes the ETH cap whenever a previous claimer calls again, nullifying the intended daily throttle.

Description

  • During normal operation the faucet should accumulate dailyDrips across all claimers until a new UTC day starts, ensuring the Sepolia ETH budget is enforced.

  • Because the else branch (executed for callers who already claimed ETH) unconditionally sets dailyDrips = 0, any repeat caller restarts the daily counter and lets subsequent claims exceed the configured cap.

if (!hasClaimedEth[faucetClaimer] && !sepEthDripsPaused) {
...
} else {
@> dailyDrips = 0;
@> // Daily counter wiped whenever a prior claimer calls again
}

Risk

Likelihood:

  • The reset fires on every legitimate repeat visitor who returns for a token-only claim after already receiving ETH.

  • Attackers can script alternating addresses that toggle the branch to keep the counter at zero throughout the day.

Impact:

  • The faucet spends more ETH than the owner allocated in dailySepEthCap, potentially exhausting the treasury.

  • Accounting metrics relying on dailyDrips become meaningless, making it impossible to detect anomalous spend patterns.

Proof of Concept

The PoC calls the faucet twice from the same address to show the dailyDrips counter resetting to zero for repeat callers.

// First claim earns ETH and sets hasClaimedEth[msg.sender] = true
faucet.claimFaucetTokens();
​
// Subsequent call hits the else branch, wiping the daily counter
faucet.claimFaucetTokens(); // dailyDrips reset to 0, cap silently bypassed

Recommended Mitigation

Implementing the change removes the unconditional reset and relies on the day-rolling logic instead, keeping the ETH cap intact.

--- a/src/RaiseBoxFaucet.sol
+++ b/src/RaiseBoxFaucet.sol
@@ -166,9 +166,6 @@ contract RaiseBoxFaucet is ERC20, Ownable {
faucetClaimer,
address(this).balance < sepEthAmountToDrip ? "Faucet out of ETH" : "Daily ETH cap reached"
);
}
- } else {
- dailyDrips = 0;
}
/**
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyDrips Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.