Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Lack of Access Control for `faucetClaimer` Updates

ambitiousdydx

Description

The faucetClaimer public state variable is updated to msg.sender in claimFaucetTokens without additional access control. Its persistent storage and public visibility could lead to confusion or misuse in external integrations, as it’s unclear why it’s stored beyond the transaction.

// Root cause in the codebase with @> marks to highlight the relevant section
@>address public faucetClaimer;
​
function claimFaucetTokens() public {
@>faucetClaimer = msg.sender; // Unnecessary persistent storage
// ... rest of function ...
}

Risk

Likelihood:

  • Occurs when external contracts or users rely on faucetClaimer for state tracking, misinterpreting its purpose.

  • Occurs during any claim, as the variable is always updated.

Impact:

  • Causes confusion in integrations expecting faucetClaimer to represent a specific state.

  • Minimal direct security impact but could lead to integration errors.

Proof of Concept

Explanation: The PoC demonstrates how faucetClaimer is overwritten with each claim, potentially confusing external systems that rely on it. After user1 claims, faucetClaimer is set to user1, but user2’s claim immediately overwrites it, making it unreliable for tracking.

function testFaucetClaimerConfusion(RaiseBoxFaucet faucet) public {
vm.prank(user1);
faucet.claimFaucetTokens(); // Sets faucetClaimer to user1
assertEq(faucet.getClaimer(), user1);
vm.prank(user2);
faucet.claimFaucetTokens(); // Overwrites to user2, confusing external trackers
}

Recommended Mitigation

Explanation: We remove the faucetClaimer state variable and use a local variable (claimant) within claimFaucetTokens. This eliminates the need for persistent storage, reduces confusion, and maintains the same functionality using msg.sender directly.

- address public faucetClaimer;
​
function claimFaucetTokens() public {
- faucetClaimer = msg.sender;
+ address claimant = msg.sender; // Use local variable
// Replace faucetClaimer with claimant in function
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.