Root + Impact

Description

• The dailyDrips variable, which tracks the amount of Sepolia ETH dispensed, is incorrectly reset to zero for any user who has already claimed ETH before. The check if (!hasClaimedEth[faucetClaimer] && !sepEthDripsPaused) is where the daily drip logic is contained. If a user has already claimed (hasClaimedEth is true), the else block is executed, which sets dailyDrips = 0;. This allows a malicious user to reset the daily counter by calling claimFaucetTokens with a second account, effectively resetting the daily cap for everyone else.

Risk

Likelihood:

• This occurs whenever a user who has already claimed ETH makes a subsequent (reverting) claim attempt.

• A malicious actor uses a second account to reset the counter after the dailySepEthCap has been reached.

Impact:

• The dailySepEthCap can be repeatedly bypassed, allowing the faucet's entire Sepolia ETH balance to be drained in a single day, against the contract's rules.

• This depletes a limited resource (Sepolia ETH) that is essential for new users to interact with the protocol.

Proof of Concept

Recommended Mitigation