Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Daily ETH Drip Reset, the dailyDrips may not be correct

zhongguangyang0907

Incorrect Daily ETH Drip Reset, the dailyDrips may not be correct

Description

  • Normally, dailyDrips tracks the total ETH distributed by the faucet each day and prevents distribution beyond dailySepEthCap.

  • The problem is that claimFaucetTokens() contains an else branch that resets dailyDrips whenever a claimer is not a first-time claimer. This causes the daily counter to be reset unintentionally and allows the daily cap to be bypassed.

// ./src/RaiseBoxFaucet.sol
// Root cause in the codebase with @> marks to highlight the relevant section
if (!hasClaimedEth[faucetClaimer] && !sepEthDripsPaused) {
// normal rewarding logic for first-time claimers
...
} else {
// @> This line resets the daily drip counter for non-first-time claimers
dailyDrips = 0;
}

Risk

Likelihood:

  • Occurs each time a returning user (one who has already claimed ETH before) calls claimFaucetTokens() during the same day.

  • Multiple returning users calling the faucet within the same day repeatedly trigger the reset, enabling repeated bypasses.

Impact:

  • The faucet can distribute more ETH than the configured daily cap (dailySepEthCap).

  • Faucet funds may be drained faster than intended; economic assumptions and downstream systems relying on the cap may be violated.

Proof of Concept

// Pseudocode / test sequence demonstrating the bypass
​
// Setup
uint256 dailySepEthCap = 5 ether;
uint256 dailyDrips = 4 ether;
​
// Step 1: First-time claimer A calls faucet and receives 1 ETH
// Inside if (!hasClaimedEth[A] && !sepEthDripsPaused) { ... }
dailyDrips = dailyDrips + 1 ether; // dailyDrips == 5 ether
​
// Step 2: Returning user B (hasClaimedEth[B] == true) calls faucet
// else branch executes:
dailyDrips = 0; // <-- reset occurs (vulnerability trigger)
​
// Step 3: Faucet can now distribute ETH again up to dailySepEthCap,
// effectively bypassing the original daily cap for the same calendar day.

Recommended Mitigation

- if (!hasClaimedEth[faucetClaimer] && !sepEthDripsPaused) {
- ...
- } else {
- dailyDrips = 0;
- }
+ if (!hasClaimedEth[faucetClaimer] && !sepEthDripsPaused) {
+ ...
+ }
+ // Removed: resetting dailyDrips in the else branch so dailyDrips consistently
+ // reflects ETH distributed during the current day and cannot be bypassed by
+ // calls from returning users.
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyDrips Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.