Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`burnFaucetTokens` burns the entire token balance instead of the specified amount.

0xnigthswatch

Root + Impact

Description

  • burnFaucetTokens() is called by the owner in oder to burn a specific amount of token and the amount of token is specified as input to the function. Then, the amountToBurn must be transfer to the owner address and then burned. This is the expected behavior.

  • The issue here is that the contract transfer to the owner balanceOf(address(this)), which is the total balance of the contract and then only burn amountToBurn.

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
// transfer faucet balance to owner first before burning
// ensures owner has a balance before _burn (owner only function) can be called successfully
@> _transfer(address(this), msg.sender, balanceOf(address(this)));
​
_burn(msg.sender, amountToBurn);
}

Risk

Likelihood:

  • It will occur whenever an owner try to burn any amountToBurn

Impact:

  • his behavior can deplete the contract’s entire token reserve, break the intended tokenomics, and cause loss of tokens meant to remain in the contract.

  • Excessive and unintended token transfer, allowing the owner to receive more tokens than intended to burn

  • Breaks the limitation that prevents owner from receiving faucet tokens

Proof of Concept

function test_burnFaucetTokens_depletes_faucet_tokens() public {
// assume that use owner deciced to burn 1/2 of INITIAL_SUPPLY_MINTED
uint256 amountToBurn = INITIAL_SUPPLY_MINTED / 2;
​
vm.prank(owner);
raiseBoxFaucet.burnFaucetTokens(amountToBurn);
​
// burnFaucetTokens will transfer all tokens to owner and amountToBurn
// contract will burn half INITIAL_SUPPLY_MINTED and give the owner the other half
assert(raiseBoxFaucet.getBalance(owner) == (INITIAL_SUPPLY_MINTED / 2));
assert(raiseBoxFaucet.getBalance(address(raiseBoxFaucet)) == 0);
}

Recommended Mitigation

No need to transfer to owner is order to burn; owner can burn directly from a contract the amount that need to be burned.

​
function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
// transfer faucet balance to owner first before burning
// ensures owner has a balance before _burn (owner only function) can be called successfully
- _transfer(address(this), msg.sender, balanceOf(address(this)));
​
- _burn(msg.sender, amountToBurn);
+ _burn(address(this), amountToBurn);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.