Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: low
Invalid

Lack of Access Control on `mintFaucetTokens` Destination Allows Misuse

shahparv1310

The mintFaucetTokens function is restricted to the owner, but it allows the owner to specify any address as the recipient — with only a check that the address must be address(this):

if (to != address(this)) {
revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
}

However, this check is redundant and misleading:

-The function accepts a to parameter, but it must always be the contract itself.

-This creates confusion and opens the door for future misuse if the check is removed or bypassed.

-It also violates the principle of least privilege — the function should not accept a parameter at all if only one value is valid.

Impact:

-Confusing and misleading API design.

-Potential for future misuse if the check is weakened.

-Increases audit surface and complexity.

-Violates clarity and minimalism in secure contract design.

Proof of Concept:

// This call is valid but redundant:
faucet.mintFaucetTokens(address(faucet), 100 ether);
​
// This call will revert, but the function misleadingly accepts it:
faucet.mintFaucetTokens(address(0xBEEF), 100 ether);

Recommended Mitigation:

Simplify the function by removing the to parameter entirely:

- function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
- if (to != address(this)) {
- revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
- }
- _mint(to, amount);
- emit MintedNewFaucetTokens(to, amount);
+ function mintFaucetTokens(uint256 amount) public onlyOwner {
+ _mint(address(this), amount);
+ emit MintedNewFaucetTokens(address(this), amount);
}

This improves clarity, reduces risk, and enforces correct usage by design.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.