Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[H]Over-transfer in `RaiseBoxFaucet::burnFaucetTokens`to the owner account as lose of all the token of the contract

shahparv1310

Description:
The RaiseBoxFaucet::burnFaucetTokensfunction is designed to allow the contract owner to burn a specific amount of faucet tokens.
However, before burning, it transfers the entire token balance held by the contract to the owner using:

_transfer(address(this), msg.sender, balanceOf(address(this)));

This means that even if the owner intends to burn only a small portion (e.g., 1,000 tokens), they will receive all tokens held by the contract (e.g., 10,000 tokens),
and only the specified amount will be burned. The remaining tokens stay in the owner's wallet, which violates the principle of least privilege and could lead to misuse or inflation.

Impact:

1.Excess token transfer: Owner receives more tokens than intended.

2.Token supply distortion: Tokens meant to be burned are instead retained.

3.Trust and auditability concerns: Users and auditors may question the integrity of the faucet’s tokenomics.

4.Potential abuse: Owner could repeatedly call this function to drain tokens under the guise of burning.

Proof of Concept :

To verify the issue put this test on the RaiseBoxFaucet.t.sol

​
function testOverTransferBeforeBurn() public {
uint256 initialContractBalance = faucet.balanceOf(address(faucet));
uint256 amountToBurn = 100 ether;
​
// Confirm contract holds full initial supply
assertEq(initialContractBalance, 1000 ether, "Contract should hold initial supply");
​
// Simulate owner calling burnFaucetTokens
vm.prank(owner);
faucet.burnFaucetTokens(amountToBurn);
​
// Owner should now hold all tokens minus burned amount
uint256 ownerBalance = faucet.balanceOf(owner);
assertEq(ownerBalance, initialContractBalance - amountToBurn, "Owner received excess tokens");
​
// Contract balance should be zero
assertEq(faucet.balanceOf(address(faucet)), 0, "Contract should be empty");
​
// Total supply should only be reduced by amountToBurn
uint256 expectedSupply = 1000 ether - amountToBurn;
assertEq(faucet.totalSupply(), expectedSupply, "Incorrect total supply after burn");
}

Recommended Mitigation:

Replace the full balance transfer with a transfer of only the amount intended to be burned in the RaiseBoxFaucet::burnFaucetTokens function.
Then verify the owner has enough balance and emit a burn event:

- _transfer(address(this), msg.sender, balanceOf(address(this)));
+ _transfer(address(this), msg.sender, amountToBurn);
+ require(balanceOf(msg.sender) >= amountToBurn, "Owner balance too low to burn");
​
_burn(msg.sender, amountToBurn);
​
+ emit BurnedFaucetTokens(msg.sender, amountToBurn);
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.