Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Unnecessary `to` Parameter in `RaiseBoxFaucet::mintFaucetTokens`

0xzhd

Root + Impact

Description

The mintFaucetTokens function allows the contract owner to mint new ERC20 tokens, but it only permits minting to the contract's own address (address(this)) through a check (if (to != address(this))). This makes the to parameter redundant, as the function's logic ensures tokens can only be minted to the contract itself.

Using an unnecessary parameter reduces code clarity and may slightly increase gas costs due to additional storage and processing of the parameter. Removing the to parameter and hardcoding address(this) would simplify the function while maintaining its intended functionality.

// @> Root cause in the codebase
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
// @> Unnecessary parameter and check
if (to != address(this)) {
revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
}
if (balanceOf(address(to)) > 1000 * 10 ** 18) {
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
_mint(to, amount);
emit MintedNewFaucetTokens(to, amount);
}

Risk

Likelihood:

  • Developers misinterpret the purpose of the to parameter, assuming minting to other addresses is possible despite the restriction.

  • Future maintenance introduces errors if the to parameter is mistakenly assumed to support other addresses.

Impact:

  • Reduced code readability makes it harder for auditors and developers to quickly understand the function's intent.

  • Slight increase in gas costs due to processing and checking the unnecessary to parameter.

Proof of Concept

The current implementation includes an unnecessary parameter and check:

// Current implementation
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
if (to != address(this)) {
revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
}
​
​
// Proposed implementation
function mintFaucetTokens(uint256 amount) public onlyOwner {
​

Recommended Mitigation

Remove the to parameter and hardcode address(this) in the _mint call to simplify the function and reduce gas costs.

- error RaiseBoxFaucet_MiningToNonContractAddressFailed();
.
.
.
- function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
- if (to != address(this)) {
- revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
- }
- if (balanceOf(address(to)) > 1000 * 10 ** 18) {
+ function mintFaucetTokens(uint256 amount) public onlyOwner {
+ if (balanceOf(address(this)) > 1000 * 1e18) {
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
- _mint(to, amount);
- emit MintedNewFaucetTokens(to, amount);
+ _mint(address(this), amount);
+ emit MintedNewFaucetTokens(address(this), amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 14 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.