Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy allows to bypass claim cooldown

al88nsk

Description

Function RaiseBoxFaucet::claimFaucetTokens is vulnerable to reentrancy attacks and allows to bypass claim cooldown. The function does not follow the Checks Effects Interactions pattern and it sets lastClaimTime value for faucetClaimer after call is called to send Eth to faucetClaimer. This allows to re-enter in the function. After that all validations are passwd and _transfer(address(this), faucetClaimer, faucetDrip) is called again, allowing to bypass cooldown.

function claimFaucetTokens() public {
// Checks
...
@> if (block.timestamp < (lastClaimTime[faucetClaimer] + CLAIM_COOLDOWN)) {
revert RaiseBoxFaucet_ClaimCooldownOn();
}
​
// drip sepolia eth to first time claimers if supply hasn't ran out or sepolia drip not paused**
// still checks
if (!hasClaimedEth[faucetClaimer] && !sepEthDripsPaused) {
...
​
if (dailyDrips + sepEthAmountToDrip <= dailySepEthCap && address(this).balance >= sepEthAmountToDrip) {
hasClaimedEth[faucetClaimer] = true;
dailyDrips += sepEthAmountToDrip;
​
@> (bool success,) = faucetClaimer.call{value: sepEthAmountToDrip}("");
​
if (success) {
emit SepEthDripped(faucetClaimer, sepEthAmountToDrip);
} else {
revert RaiseBoxFaucet_EthTransferFailed();
}
} else {
...
}
} else {
...
}
​
​
// Effects
​
@> lastClaimTime[faucetClaimer] = block.timestamp;
dailyClaimCount++;
​
// Interactions
@> _transfer(address(this), faucetClaimer, faucetDrip);
​
...
}
​

Risk

Likelihood: High

Anyone can bypass claim cooldown.

Impact: High

Bypass claim cooldown allows to claim more tokens that it is allowed.

Recommended Mitigation

Follow Checks Effects Interactions pattern and transfer Eth after all changes to storage is done.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Reentrancy in `claimFaucetTokens`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.