Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Hardcoded Decimals Assumption

ambitiousdydx

Description

The contract assumes 18 decimals for token calculations (e.g., INITIAL_SUPPLY, mintFaucetTokens checks) without using the decimals() function. If a subclass overrides decimals() (e.g., to 6), these hardcoded values will result in incorrect token amounts, disrupting the faucet’s functionality.

// Root cause in the codebase with @> marks to highlight the relevant section
constructor(...) {
@>_mint(address(this), 1000000000 * 10 ** 18); // Hardcoded 18 decimals
}
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
@>if (balanceOf(address(to)) > 1000 * 10 ** 18) { // Hardcoded 18 decimals
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
}

Risk

Likelihood:

  • Occurs when the contract is extended with a different decimals() value.

  • Occurs during deployment or minting operations that rely on hardcoded values.

Impact:

  • Incorrect token amounts are minted or checked, leading to financial errors.

  • Disrupts the faucet’s purpose for testnet interactions.

Proof of Concept

Explanation: The PoC shows how extending the contract with a different decimals() value causes incorrect token amounts. If decimals() is overridden to return 6, the INITIAL_SUPPLY becomes much smaller than intended, affecting all token calculations.

contract CustomRaiseBoxFaucet is RaiseBoxFaucet {
function decimals() public pure override returns (uint8) {
return 6;
}
}
// Deploy with 6 decimals, INITIAL_SUPPLY becomes 1000000000 * 10**6, drastically reducing supply

Recommended Mitigation

Explanation: We update the contract to use decimals() for all token calculations, ensuring consistency with the token’s actual decimal places. This prevents errors if decimals() is overridden and maintains correct token amounts.

constructor(...) {
- _mint(address(this), 1000000000 * 10 ** 18);
+ _mint(address(this), 1000000000 * 10 ** decimals());
}
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
- if (balanceOf(address(to)) > 1000 * 10 ** 18) {
+ if (balanceOf(address(to)) > 1000 * 10 ** decimals()) {
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.