Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

[L-1] Centralization Risk

chargingfoxsec

[L-1] Centralization Risk

Description

  • Normal behavior: Administrative privileges should be limited and documented; owner-controlled actions must be intentional and auditable.

  • Specific issue: the contract exposes multiple onlyOwner functions (mint, burn, refill, pause) granting the owner broad control.

// @> owner-only functions
function mintFaucetTokens(address to, uint256 amount) public onlyOwner { ... }
function burnFaucetTokens(uint256 amountToBurn) public onlyOwner { ... }
function refillSepEth(uint256 amountToRefill) external payable onlyOwner { ... }
function toggleEthDripPause(bool _paused) external onlyOwner { ... }

Risk

Likelihood:Low

  • Owner will call admin functions during normal maintenance or upgrades.

  • Misuse occurs when owner keys are compromised or the owner acts maliciously.

Impact:Low

  • Owner can change token supply or drain/alter faucet behavior.

  • Centralization increases trust requirement on the owner.

Proof of Concept

// As owner: call mintFaucetTokens(...) or refillSepEth(...) to change state.

Recommended Mitigation

- // owner-only direct controls
- function mintFaucetTokens(address to, uint256 amount) public onlyOwner { ... }
- function toggleEthDripPause(bool _paused) external onlyOwner { ... }
+ // recommend multisig or timelock for dangerous admin functions
+ // e.g. restrict via a multisig or TimeLockController
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.