Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect lastFaucetDripDay set, dailyClaimCount may not be actually counted by a day

zhongguangyang0907

Incorrect lastFaucetDripDay set, dailyClaimCount may not be actually counted by a day

Description

  • Normally, dailyClaimCount should reset on a calendar-aligned day boundary (or a consistent 24-hour window) so that daily limits are enforced consistently.

  • The issue is that lastFaucetDripDay is assigned the raw block.timestamp when the reset runs, causing the “daily” period to start at the exact timestamp of the first reset rather than a day-aligned boundary.

// ./src/RaiseBoxFaucet.sol
// Root cause in the codebase with @> marks to highlight the relevant section
if (block.timestamp > lastFaucetDrip + 1 days) {
// @> bug: assigns exact timestamp instead of a day-aligned value
lastFaucetDripDay = block.timestamp;
dailyClaimCount = 0;
}

Risk

Likelihood:

  • When the reset condition (more than 24 hours since lastFaucetDrip) is met, the code assigns lastFaucetDripDay to the current block.timestamp.

  • When the first claim that triggers the reset occurs at an arbitrary time during a calendar day, subsequent 24-hour windows align to that arbitrary time rather than calendar days.

Impact:

  • The faucet’s daily claim enforcement may be inconsistent across calendar days.

  • Users may be able to claim more than the intended per-calendar-day limit depending on when the first reset occurs.

Proof of Concept

// Example timeline (timestamps are illustrative):
// 1) 2025-10-15 23:50:00 -> first reset occurs:
// lastFaucetDripDay = 2025-10-15 23:50:00; dailyClaimCount = 0
// 2) 2025-10-16 00:10:00 -> users can still claim (same calendar day) because window aligned to 23:50
// 3) 2025-10-16 23:49:00 -> less than 24h since lastFaucetDripDay, dailyClaimCount not reset
// Result: more claims across calendar date 2025-10-16 than intended.

Recommended Mitigation

- lastFaucetDripDay = block.timestamp;
+ lastFaucetDripDay = (block.timestamp / 1 days) * 1 days;
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Inconsistent day calculation methods cause desynchronization between ETH and token daily resets.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!