Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

[M-2] Unbounded External ETH Call Allows Malicious Gas Consumption

chargingfoxsec

[M-2] Unbounded External ETH Call Allows Malicious Gas Consumption

Description

  • Normal behavior: The faucet should send Sepolia ETH to first-time claimers safely without allowing the recipient to consume arbitrary gas or affect contract invariants.

  • Specific issue: the contract performs an unchecked external call to the claimant with no gas limit (faucetClaimer.call{ value: sepEthAmountToDrip }("")), allowing a malicious fallback/receive to consume large gas or revert, wasting gas or causing the claim to fail.

hasClaimedEth[faucetClaimer] = true;
dailyDrips += sepEthAmountToDrip;
​
@> (bool success, ) = faucetClaimer.call{ value: sepEthAmountToDrip }("");
if (!success) revert RaiseBoxFaucet_EthTransferFailed();

Risk

Likelihood:

  • When a claimant is a contract with a malicious fallback, the fallback runs and can consume large gas during the call.

  • Automated bots can target the faucet by acting as contract claimants to force extra gas usage or failed transfers.

Impact:

  • Loss of gas for the transaction sender and possible repeated failed attempts.

  • Denial-of-service for legitimate claimers (claims revert or are blocked) and potential griefing of faucet funds/availability.

Proof of Concept

contract Malicious {
receive() external payable {
// burn gas intentionally
for (uint i = 0; i < 100000; i++) { uint x = i**2; }
}
}
​
// Deploy Malicious and call faucet.claimFaucetTokens() from Malicious to cause heavy gas usage or revert.

Recommended Mitigation

-(bool success, ) = faucetClaimer.call{ value: sepEthAmountToDrip }("");
+(bool success, ) = faucetClaimer.call{ value: sepEthAmountToDrip, gas: 2300 }("");
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.