Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Incorrect claim restriction check

eze001

Root + Impact

Description

Expected behavior:
Only non-owner users should claim.

Actual behavior:

Uses equality comparison incorrectly, allowing bypass.

@> if (faucetClaimer == address(0) || faucetClaimer == address(this) || faucetClaimer == Ownable.owner())
​

Risk

Likelihood:

  • The flawed check (faucetClaimer == Ownable.owner() / similar equality comparisons) is a logic mistake rather than a direct coding bug (like a missing onlyOwner). Logic mistakes are less obviously exploitable in many deployments, so the baseline likelihood is not high.

Impact:

  • Owner may bypass restriction if inherited logic changes.

Proof of Concept

Owner calls claim function after overriding ownership context.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
​
/*
PoC: Demonstrates bypassing incorrect claim restriction that compares `faucetClaimer` to `owner()`
This attacker deploys a malicious wrapper that overrides `owner()` or breaks the assumption
used in the original claim restriction logic.
*/
​
interface IVulnerableFaucet {
function claimFaucetTokens() external;
function owner() external view returns (address); // from Ownable
}
​
contract OwnerBypassPoC {
IVulnerableFaucet public faucet;
​
constructor(address _faucet) {
faucet = IVulnerableFaucet(_faucet);
}
​
// Override owner() to return something the target contract compares against
function owner() public view returns (address) {
// Return the address that the faucet thinks is the owner (itself or deployer)
// You can adjust this to match what the faucet uses in its flawed check
return address(this); // This may match faucet.owner() == faucetClaimer
}
​
// Exploit claim restriction by tricking contract into thinking we're not the owner
function exploit() external {
faucet.claimFaucetTokens();
}
}
​

Recommended Mitigation

Use _msgSender() consistently and check against owner() directly

Use _msgSender() and owner() directly for clarity.
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.