Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-03] Integer Overflow in totalFees Causes Loss of Protocol Revenue

rensley

Root + Impact

Description

  • The totalFees variable is declared as uint64 (max value ~18.4 ETH) but the fee calculation uses uint256.

  • When fees exceed uint64 max, the unsafe downcast causes silent overflow, resetting totalFees to a small value and permanently losing protocol revenue.

// Root cause in the codebase with @> marks to highlight the relevant section
​
@> uint64 public totalFees = 0; // Max value: 18,446,744,073,709,551,615 wei (~18.4 ETH)
​
function selectWinner() external {
// ...
uint256 fee = (totalAmountCollected * 20) / 100; // uint256
@> totalFees = totalFees + uint64(fee); // Unsafe downcast - OVERFLOW!
// ...
}

Risk

Likelihood:

  • Reason 1 // Requires ~92 ETH in total raffle entries to trigger

  • Reason 2 // With 1 ETH entrance fee, needs ~92 players over contract lifetime

Impact:

  • Protocol loses all accumulated fees above overflow threshold

  • Owner withdraws significantly less than actual fees collected

  • No revert or warning when overflow occurs

Proof of Concept

The following test demonstrates how fees are lost when the uint64 overflows.

function testIntegerOverflowTotalFees() public {
// Setup: Create scenario where totalFees will overflow
// uint64 max = 18,446,744,073,709,551,615 wei (~18.4 ETH)
uint256 playersRequired = 100; // 100 ETH total, 20 ETH fees per round
// Run multiple raffles to accumulate fees
for (uint256 round = 0; round < 5; round++) {
// Enter 100 players (simplification - would need unique addresses)
// Each round adds 20 ETH to fees
// After ~1 round, totalFees = 20 ETH, exceeds uint64 max of 18.4 ETH
}
// totalFees has overflowed - shows small number instead of actual fees
uint64 reportedFees = puppyRaffle.totalFees();
// reportedFees << actual fees collected due to overflow
}

Recommended Mitigation

Change totalFees to uint256 to match the calculation type.

- uint64 public totalFees = 0;
+ uint256 public totalFees = 0;
​
function selectWinner() external {
// ...
- totalFees = totalFees + uint64(fee);
+ totalFees = totalFees + fee;
// ...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!