Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

[L-3] Incosistent `dailySepEthCap` value in deploy and test scripts, can lead to wrong test conclusions

Author Revealed upon completion

[L-3] Incosistent dailySepEthCap value in deploy and test scripts, can lead to wrong test conclusions

Description

  • Expected bahaviour The value of dailySepEthCap is set upon deployment. The README does not detail which cap will be used. The deploy script and the test scripts should use consistent cap values, given that the value never changes after the contract is deployed.

  • Problematic bahaviour The deploy script uses 1 ether as the dailySepEthCap, while the test script 0.5 ether. If the 0.5 ether value is the correct one, the deploy script should be adjusted.

Root cause:

function run() public {
vm.startBroadcast();
raiseBox = new RaiseBoxFaucet(
"raiseboxtoken",
"RB",
1000 * 10 ** 18,
0.005 ether,
@> 1 ether
);
vm.stopBroadcast();
}

Risk

Likelihood: Low

  • Given that the dailySepEthCap threshold is set upon deployment, an incorrect assignment will affect all incoming transactions. However, this incosistency will be reviewed before deployment, reducing its likelihood.

Impact: Low

  • An incorrect threshold assignment will impact the number of first-time user claims that can be processed by the faucet.

  • If 0.5 ether is the intended cap value, assigning it to 1 ether will allow double the amount of eth claims, draining the eth balance of the contract much faster.

Proof of Concept

A PoC is not necessary.

​

Recommended Mitigation

If 0.5 ether is the intended dailySepEthCap value, change the deploy script to:

function run() public {
vm.startBroadcast();
raiseBox = new RaiseBoxFaucet(
"raiseboxtoken",
"RB",
1000 * 10 ** 18,
0.005 ether,
- 1 ether
+. 0.5 ether
);
vm.stopBroadcast();
}

Enhance the contract's documentation accordingly so that the intend is clear.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.