Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`burnFaucetTokens` Transfers Entire Balance Instead of Specified Amount

yxsec

Root + Impact

Description

  • The burnFaucetTokens function is designed to accept an amountToBurn parameter, allowing the owner to burn a specific amount of faucet tokens.

  • The function incorrectly transfers the entire contract balance (balanceOf(address(this))) to the owner instead of the specified amountToBurn amount, causing unintended behavior when partial burns are attempted.

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
// @> transfer faucet balance to owner first before burning
// @> ensures owner has a balance before _burn (owner only function) can be called successfully
_transfer(address(this), msg.sender, balanceOf(address(this))); // @> BUG: transfers ALL instead of amountToBurn
​
_burn(msg.sender, amountToBurn);
}

Risk

Likelihood:

  • This occurs every time the owner calls burnFaucetTokens with any amount

  • The bug is guaranteed to manifest when trying to burn less than the full balance

  • Testing may not catch this if only full-balance burns are tested

Impact:

  • Owner receives more tokens than intended when burning

  • Partial burns are impossible - always transfers full balance

  • Contract accounting becomes incorrect

  • Breaks the intended burn mechanism

  • If contract holds 10,000 tokens and owner wants to burn 1,000, they receive all 10,000 tokens

Proof of Concept

function testBurnFaucetTokensTransfersWrongAmount() public {
// Setup: Contract has 1,000,000,000 tokens
uint256 contractBalance = raiseBoxFaucet.balanceOf(address(raiseBoxFaucet));
assertEq(contractBalance, 1_000_000_000 * 10**18);
// Owner wants to burn only 500 tokens
uint256 amountToBurn = 500 * 10**18;
vm.prank(owner);
raiseBoxFaucet.burnFaucetTokens(amountToBurn);
// BUG: Owner receives ALL tokens (1B), not just 500
uint256 ownerBalance = raiseBoxFaucet.balanceOf(owner);
assertEq(ownerBalance, contractBalance); // Receives everything!
// Contract has 0 tokens left
assertEq(raiseBoxFaucet.balanceOf(address(raiseBoxFaucet)), 0);
}

Recommended Mitigation

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
- _transfer(address(this), msg.sender, balanceOf(address(this)));
+ _transfer(address(this), msg.sender, amountToBurn);
​
_burn(msg.sender, amountToBurn);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.