Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

`burnFaucetTokens` transfers entire contract balance instead of the requested burn amount

Author Revealed upon completion

burnFaucetTokens transfers entire contract balance instead of the requested burn amount

Description

burnFaucetTokens currently does:

@> _transfer(address(this), msg.sender, balanceOf(address(this)));
@> _burn(msg.sender, amountToBurn);
​

This transfers the entire faucet contract token balance to owner (not only amountToBurn). Then it burns amountToBurn from owner. The result: owner gets all current faucet tokens even when they intended to burn only amountToBurn, and leftover tokens remain with owner instead of being burned.

Impact: Owner can accidentally (or maliciously) receive the entire faucet balance when burning a smaller amount, changing the token distribution and draining the faucet.

Risk

Likelihood: Medium

Impact: Medium (owner receiving more tokens than intended)

Proof of Concept

1. Faucet has 1,000 tokens.
​
2. Owner calls `burnFaucetTokens(1)`.
​
3. Owner receives 1,000 tokens from contract, then `_burn` burns 1 token -> owner ends up with 999 extra tokens.

Recommended Mitigation

Transfer exactly amountToBurn before burning (or directly call _burn(address(this), amount) if allowed by design and if _burn accepts burning from contract without transferring).

Option A - transfer amountToBurn then burn:

- _transfer(address(this), msg.sender, balanceOf(address(this)));
- _burn(msg.sender, amountToBurn);
+ // Transfer only the amount intended to burn, then burn it from owner
+ _transfer(address(this), msg.sender, amountToBurn);
+ _burn(msg.sender, amountToBurn);
​

Option B - if you want to burn directly from contract (preferred to avoid transfers):

- _transfer(address(this), msg.sender, balanceOf(address(this)));
- _burn(msg.sender, amountToBurn);
+ // Burn directly from contract balance (no transfer)
+ _burn(address(this), amountToBurn);

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.