Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

fallback() emits SepEthDonated for zero or unintended calls

vk1033

fallback() emits SepEthDonated for zero or unintended calls

Description

  • Normal behavior: donation handlers should only log/accept meaningful ETH transfers; fallback should not emit donation events for zero-value or accidental calls so off-chain monitors don’t get misleading signals.

  • Specific issue: the contract's fallback accepts any call (including zero-value calls) and emits SepEthDonated(msg.sender, msg.value) without validating msg.value. This allows anyone to spam the contract with zero-value calls that produce donation events, pollute logs, and mislead monitoring/alerting systems.

// @> fallback accepts all calls and emits an event even when msg.value == 0
fallback() external payable {
@> emit SepEthDonated(msg.sender, msg.value);
}

Risk

Likelihood: medium

  • Any external account or contract can call the fallback repeatedly (no auth), including bots and malconfigured tools.

Impact: Low

  • Event log pollution and false-positive donation signals for monitoring systems and analytics.

Proof of Concept

This PoC shows event SepEthDonated is emiited even when nothing is donated

function test_fallback_emits_on_zero_value_call_with_data() public {
// expect SepEthDonated with 0 value
vm.expectEmit(true, false, false, true);
emit SepEthDonated(address(this), 0);
​
// call with non-empty data and zero value -> triggers fallback()
(bool ok,) = address(raiseBoxFaucet).call(hex"01");
require(ok, "call failed");
}

Recommended Mitigation

  • Emit only on non-zero value (silent no-op on zero-value calls):

fallback() external payable {
+ if (msg.value == 0) {
+ return;
+ }
emit SepEthDonated(msg.sender, msg.value);
}

  • Accept donations via receive() only and reject unexpected fallback calls (recommended):

fallback() external payable {
+ revert("Invaild call");
- emit SepEthDonated(msg.sender, msg.value);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.