Raisebox Faucet

First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: high
Valid

Incorrect daily ETH drip counter reset allows bypass of daily distribution caps

Description:

The claimFaucetTokens() function contains a logic error in how it manages the dailyDrips counter, which tracks the total amount of Sepolia ETH distributed per day. The vulnerability exists in the else block at the end of the ETH distribution logic:

if (!hasClaimedEth[faucetClaimer] && !sepEthDripsPaused) {
// ETH distribution logic for first-time claimers
...
} else {
dailyDrips = 0; // @audit Incorrectly resets counter
}

This else block executes whenever:

  1. A user has already claimed ETH before (hasClaimedEth[faucetClaimer] == true), OR

  2. ETH drips are paused (sepEthDripsPaused == true)

The problem is that dailyDrips gets reset to zero every time a repeat claimer calls the function, even though no actual day change has occurred. This breaks the tracking mechanism that enforces the dailySepEthCap limit.

Impact:

More Sepolia ETH can be distributed per day than intended, potentially draining the contract's ETH balance faster than expected

Recommended Mitigation:

Remove the else block entirely. The dailyDrips counter should only be reset when a new day begins, which is already handled correctly inside the first-time claimer logic

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyDrips Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.