Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

dailyClaimCount Fails to Reset, Causing Permanent Denial of Service

folijr01

Root + Impact

Description

The logic to reset the dailyClaimCount is flawed and only triggers when a claim is made after a 24-hour period has passed since the last claim that triggered a reset. If claims are made consistently every day, but more than 24 hours apart, the dailyClaimCount will increment but never reset. Once dailyClaimCount reaches dailyClaimLimit, the condition if (dailyClaimCount >= dailyClaimLimit) will be true forever, blocking all future claims for every user.

// Root cause in the codebase with @> marks to highlight the relevant section// This check is only reached during a claim. If no claims are possible, it's never reached.
if (block.timestamp > lastFaucetDripDay + 1 days) {
lastFaucetDripDay = block.timestamp;
dailyClaimCount = 0;
}

Risk

Likelihood:

  • This occurs when the dailyClaimLimit is reached on any given day.

  • No new claims are made for more than 24 hours, preventing the faulty reset logic from triggering.

Impact:

  • The faucet will be permanently bricked, and no user will be able to claim tokens ever again.

  • This constitutes a total denial of service for the contract's primary function, requiring a complete redeployment to fix.

Proof of Concept

// This check is only reached during a claim. If no claims are possible, it's never reached.
if (block.timestamp > lastFaucetDripDay + 1 days) {
lastFaucetDripDay = block.timestamp;
dailyClaimCount = 0;
}

Recommended Mitigation

// ... existing checks ...
​
- if (block.timestamp > lastFaucetDripDay + 1 days) {
- lastFaucetDripDay = block.timestamp;
- dailyClaimCount = 0;
- }
// In claimFaucetTokens function, at the very beginning of the function
+ uint256 currentDay = block.timestamp / 1 days;
+ if (currentDay > lastFaucetDripDay) {
+ lastFaucetDripDay = currentDay;
+ dailyClaimCount = 0;
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyClaimCount Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!