Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

State updates for token claim counters happen after ETH path which allows bypass of dailyClaimCount and lastClaimTime when ETH path reenters

kavindalw

Root + Impact

Description

  • Normal behaviour: lastClaimTime and dailyClaimCount must be updated before any external interactions to prevent double-claiming or bypassing limits.

  • Problem: lastClaimTime[faucetClaimer] = block.timestamp; and dailyClaimCount++ are assigned after the ETH transfer and after checks that could be re-entered. Combined with the reentrancy issue above, this allows repeated claims and bypasses per-day counters.

// Root cause
...
(bool success,) = faucetClaimer.call{value: sepEthAmountToDrip}("");
if (success) {
emit SepEthDripped(faucetClaimer, sepEthAmountToDrip);
} else {
revert RaiseBoxFaucet_EthTransferFailed();
}
...
// Effects
lastClaimTime[faucetClaimer] = block.timestamp;
dailyClaimCount++;
​
// Interactions
_transfer(address(this), faucetClaimer, faucetDrip);
​

Risk

Likelihood:

  • Reentrancy is feasible, so the missing earlier state update will be exploited to call again and again.

Impact:

  • Multiple claims within cooldown and daily limits, draining tokens/ETH.

Proof of Concept

​

Recommended Mitigation

Move lastClaimTime and dailyClaimCount++ to before any external calls (and before the token transfer).

- // Effects
- lastClaimTime[faucetClaimer] = block.timestamp;
- dailyClaimCount++;
-
- // Interactions
- _transfer(address(this), faucetClaimer, faucetDrip);
+ // Effects first
+ lastClaimTime[faucetClaimer] = block.timestamp;
+ dailyClaimCount++;
+ // Interactions last
+ _transfer(address(this), faucetClaimer, faucetDrip);
​

Combine this with nonReentrant and the ETH-drip ordering fix described earlier.

Updates

Lead Judging Commences

inallhonesty Lead Judge 17 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Reentrancy in `claimFaucetTokens`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.