Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

adjustDailyClaimLimit can underflow silently

eze001

Root + Impact

Description

Expected behavior:
Ensure subtraction checks properly.

Actual behavior:
When by > dailyClaimLimit, it reverts but without descriptive reason.

if (by > dailyClaimLimit) {
@> revert RaiseBoxFaucet_CurrentClaimLimitIsLessThanBy();
}
​

Risk

Although the function includes a check (if (by > dailyClaimLimit)), the revert uses a custom error (RaiseBoxFaucet_CurrentClaimLimitIsLessThanBy()), which provides no descriptive reason string. This isn't a functional vulnerability (i.e. no actual underflow or loss of funds), but it poses a risk to usability, debugging, and transparency, particularly in production or when interacting with the contract via low-level tools or UIs.

Likelihood:

adjustDailyClaimLimit()

If this function is onlyOwner, then the risk of abuse is very low — it's under the control of a trusted party.

Impact:

No actual underflow, but poor UX and clarity.

Proof of Concept

the function reverts when callers attempt to subtract more than the current dailyClaimLimit, and the revert provides a custom error (which is fine technically) but may be considered poor UX

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
contract FaucetClaimLimitTest {
uint256 public dailyClaimLimit = 5;
​
error RaiseBoxFaucet_CurrentClaimLimitIsLessThanBy();
​
// Simulate the function that reduces the daily claim limit by `by`
function adjustDailyClaimLimit(uint256 by) public {
if (by > dailyClaimLimit) {
revert RaiseBoxFaucet_CurrentClaimLimitIsLessThanBy();
}
dailyClaimLimit -= by;
}
}
​

Recommended Mitigation

Include reason string or event for transparency.

- remove this code
revert RaiseBoxFaucet_CurrentClaimLimitIsLessThanBy();
​
+ add this code
revert("adjustDailyClaimLimit: amount exceeds current limit");
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 days ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.