Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Returning users reset the ETH daily cap allowing unlimited ETH drips

mkozhuharov

Root + Impact / Returning users reset the ETH daily cap allowing unlimited ETH drips

Description

  • The protocol is designed to drip ETH to new users up to a predefined daily cap.

  • However, when a returning user makes a claim, the RaiseBoxFaucet::claimFaucetTokens function resets RaiseBoxFaucet::dailyDrips. This unintentionally allows unlimited ETH drips for new users within the same day, effectively bypassing the daily limit.

} else {
@> dailyDrips = 0;
}

Risk

Likelihood:

  • The issue occurs each time a returning user successfully claims new Faucet tokens.

Impact

  • All ETH held by the faucet can be drained in a single day. Malicious actors can exploit this by repeatedly triggering the reset with returning accounts and then using multiple new accounts to claim ETH beyond the intended cap.

Proof of Concept

Add the following test to RaiseBoxFaucet.t.sol to reproduce the issue:

function test_audit_returningUsersResetTheEthDailyCapAllowingUnlimitedEthDrips()
public
{
RaiseBoxFaucet testRaiseBox = new RaiseBoxFaucet(
"raiseboxtoken",
"RB",
1000 * 10 ** 18, // faucetDrip
0.5 ether, // sepEthDrip
1 ether // dailySepEthCap
);
vm.deal(address(testRaiseBox), 2.5 ether);
​
vm.prank(user1);
testRaiseBox.claimFaucetTokens();
​
advanceBlockTime(block.timestamp + 3 days);
​
// Make sure we have more ETH balance than the ETH cap
assertGt(address(testRaiseBox).balance, testRaiseBox.dailySepEthCap());
// user1 is a returning user
address[5] memory users = [user2, user3, user1, user4, user5];
for (uint256 i = 0; i < users.length; i++) {
vm.prank(users[i]);
testRaiseBox.claimFaucetTokens();
}
​
assertEq(address(testRaiseBox).balance, 0);
}

Recommended Mitigation

Remove the unnecessary reset of RaiseBoxFaucet::dailyDrips from the RaiseBoxFaucet::claimFaucetTokens function to ensure that the daily cap is enforced consistently for all users.

- } else {
- dailyDrips = 0;
- }
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 days ago
Submission Judgement Published
Validated
Assigned finding tags:

dailyDrips Reset Bug

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.