Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View all submissions
Previous Next
Submission Details
Severity: medium
Valid

Unsafe burnFaucetTokens Implementation Can Destroy User's Pre-existing Balance

Author Revealed upon completion

Root + Impact

Description

  • The burnFaucetTokens function is designed to burn tokens from the contract's supply. To do this, it first transfers the entire contract balance to the owner (msg.sender) and then calls _burn on the owner's balance. If the owner already holds tokens from a previous claim or transfer, these tokens are now co-mingled with the contract's supply. The subsequent _burn call will burn from this combined total, potentially destroying the owner's personal token balance.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • This occurs when the owner calls burnFaucetTokens.

  • The owner's account already has a non-zero balance of the faucet token before the call.

Impact:

  • The owner can accidentally and irreversibly destroy their own personal token holdings.

  • The function does not behave as expected, failing to isolate the tokens being burned from the owner's personal assets.

Proof of Concept

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
// The entire contract balance is sent, not just amountToBurn
_transfer(address(this), msg.sender, balanceOf(address(this)));
_burn(msg.sender, amountToBurn); // Burns from the owner's total balance
}

Recommended Mitigation

- // transfer faucet balance to owner first before burning
- // ensures owner has a balance before _burn (owner only function) can be called successfully
- _transfer(address(this), msg.sender, balanceOf(address(this)));
- _burn(msg.sender, amountToBurn);
+ _burn(address(this), amountToBurn);
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unnecessary and convoluted logic in burnFaucetTokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.