Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect `dailyClaimCount` Reset Logic

ambitiousdydx

Description

The claimFaucetTokens function resets dailyClaimCount only when a claim occurs and block.timestamp > lastFaucetDripDay + 1 days. If no claims happen for an extended period, the counter doesn’t reset, potentially blocking claims when dailyClaimCount exceeds dailyClaimLimit.

// Root cause in the codebase with @> marks to highlight the relevant section
function claimFaucetTokens() public {
// ... checks ...
@>if (block.timestamp > lastFaucetDripDay + 1 days) {
@> lastFaucetDripDay = block.timestamp;
@> dailyClaimCount = 0;
@>}
// ... state updates ...
}

Risk

Likelihood:

  • Occurs when no claims are made for more than 24 hours, delaying the reset of dailyClaimCount.

  • Occurs when dailyClaimCount reaches dailyClaimLimit, preventing further claims until a reset.

Impact:

  • Legitimate users are unable to claim tokens if the counter isn’t reset.

  • Disrupts the faucet’s functionality, leading to poor user experience.

Proof of Concept

Explanation: The PoC simulates a scenario where dailyClaimCount reaches the dailyClaimLimit, and no claims occur for over a day. Since the reset only happens during a claim, the counter remains high, causing subsequent claims to revert until a claim triggers the reset.

function testStaleCounter(RaiseBoxFaucet faucet) public {
// Simulate dailyClaimCount reaching dailyClaimLimit
vm.prank(user1);
faucet.claimFaucetTokens(); // Increments dailyClaimCount
vm.warp(block.timestamp + 2 days); // No claims for 2 days
// dailyClaimCount not reset because no claim was made
vm.prank(user2);
faucet.claimFaucetTokens(); // Reverts due to dailyClaimLimit
}

Recommended Mitigation

Explanation: We modify claimFaucetTokens to reset dailyClaimCount at the start of the function using a consistent day calculation (block.timestamp / 24 hours). This ensures the counter resets daily, even if no claims occur, preventing claim blockages.

function claimFaucetTokens() public {
+ uint256 currentDay = block.timestamp / 24 hours;
+ if (currentDay > lastFaucetDripDay) {
+ lastFaucetDripDay = currentDay;
+ dailyClaimCount = 0;
+ }
// ... existing checks ...
- if (block.timestamp > lastFaucetDripDay + 1 days) {
- lastFaucetDripDay = block.timestamp;
- dailyClaimCount = 0;
- }
// ... rest of function ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyClaimCount Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.