Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

refillSepEth() uses unnecessary parameter instead of relying on msg.value, causing minor gas inefficiency

shashankwcw

Redundant parameter amountToRefill duplicates the functionality of msg.value.
slightly higher gas usage and function call complexity.

Description

  • The refillSepEth() function allows the owner to deposit Sepolia ETH into the contract, ensuring the sent value matches the declared amount.

  • The parameter amountToRefill is redundant since msg.value already represents the transferred amount, slightly increasing gas usage and code complexity.

// Root cause in the codebase with @> marks to highlight the relevant section
function refillSepEth(uint256 amountToRefill) external payable onlyOwner {
@> require(amountToRefill > 0, "invalid eth amount");
​
@> require(msg.value == amountToRefill, "Refill amount must be same as value sent.");
​
emit SepEthRefilled(msg.sender, amountToRefill);
}

Risk

Likelihood:

  • This occurs every time the owner calls refillSepEth(), as the redundant parameter is always processed.

  • The issue consistently adds minor but unnecessary gas overhead on each execution.

Impact:

  • Slight increase in gas consumption and transaction cost due to redundant parameter handling.

  • Minor code inefficiency and deviation from Solidity best practices for minimal, clean contract design.

Proof of Concept


// When the code for refillSepEth is
function refillSepEth(uint256 amountToRefill) external payable onlyOwner {
require(amountToRefill > 0, "invalid eth amount");
​
require(msg.value == amountToRefill, "Refill amount must be same as value sent.");
​
emit SepEthRefilled(msg.sender, amountToRefill);
}
// The output for forge test --gas-report is
refillSepEth | 24292 | 24748 | 24292 | 25662 | 3 |
​
​
// When the code for refillSepEth is
function refillSepEth() external payable onlyOwner {
emit SepEthRefilled(msg.sender, msg.value);
}
​
// The output for forge test --gas-report is
​
| refillSepEth | 23815 | 24252 | 23815 | 25126 | 3 |

Recommended Mitigation

- function refillSepEth(uint256 amountToRefill) external payable onlyOwner {
- require(amountToRefill > 0, "invalid eth amount");
​
- require(msg.value == amountToRefill, "Refill amount must be same as value sent.");
​
- emit SepEthRefilled(msg.sender, amountToRefill);
- }
+ function refillSepEth() external payable onlyOwner {
+ emit SepEthRefilled(msg.sender, msg.value);
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.