Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missed Logic Burning The Faucet Token

febrian

Excessive Faucet Token Transfer Before Burning RaiseBoxFaucet::burnFaucetTokens Allows Owners to Drain the Entire Contract Balance Instead of Burning the Specified Amount

Description

The burnFaucetTokens function is intended to burn a specific amount (amountToBurn) of faucet tokens held by the contract by first transferring them to the owner.

However, the function transfers the entire contract balance balanceOf(address(this)) to the owner instead of just the amountToBurn parameter.

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
// transfer faucet balance to owner first before burning
// ensures owner has a balance before _burn (owner only function) can be called successfully
@> _transfer(address(this), msg.sender, balanceOf(address(this)));
​
_burn(msg.sender, amountToBurn);
}

Risk

Likelihood: High

  • Reason 1: The vulnerability is present in every call to `burnFaucetTokens` and there are no conditional paths that avoid it

  • Reason 2: The owner has legitimate reasons to call this function regularly for faucet maintenance

Impact: Medium

  • Impact 1: Users expecting faucet tokens to remain available in the faucet will find them unavailable after owner calls this function

  • Impact 2: The faucet functionality can be completely drained even when owner only intends to burn a small amount

Proof of Concept

Below is a test case that demonstrates calling burnFaucetTokens causes tokens drained.

function testOwnerBurnFaucet() public {
console.log("Initial contract balance:", raiseBoxFaucet.getFaucetTotalSupply());
​
uint256 amountToBurn = 1000 * 10 ** 18; // Example amount
vm.prank(owner);
raiseBoxFaucet.burnFaucetTokens(amountToBurn);
​
console.log("Final contract balance:", raiseBoxFaucet.getFaucetTotalSupply());
}

Output:

Initial contract balance: 1000000000000000000000000000
Final contract balance: 0

Recommended Mitigation

Replace balanceOf(address(this)) with amountToBurn.

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
// transfer faucet balance to owner first before burning
// ensures owner has a balance before _burn (owner only function) can be called successfully
- _transfer(address(this), msg.sender, balanceOf(address(this)));
+ _transfer(address(this), msg.sender, amountToBurn);
​
_burn(msg.sender, amountToBurn);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!