Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Silent Overflow in totalFees Variable

dod4ufn

Root + Impact

The totalFees variable is declared as uint64, but fees are calculated as uint256. When casting the fee to uint64, an overflow can silently occur. If total fees exceed 2^64 - 1 wei, the value wraps around, causing funds to be stuck and preventing the owner from withdrawing.

Description

  • The normal behavior is for fees to accumulate in the totalFees variable, which the owner can withdraw via withdrawFees.

  • The issue is that totalFees is a uint64 (max ~18 ETH), but fees are stored as uint256 before casting. If cumulative fees exceed this limit, the cast silently truncates the value, and the true amount of fees is lost, preventing correct withdrawal.

// Root cause in the codebase with @> marks to highlight the relevant section
address public feeAddress;
@> uint64 public totalFees = 0;
​
function selectWinner() external {
// ... winner selection logic ...
uint256 totalAmountCollected = players.length * entranceFee;
uint256 prizePool = (totalAmountCollected * 80) / 100;
uint256 fee = (totalAmountCollected * 20) / 100;
@> totalFees = totalFees + uint64(fee); // Unsafe cast!
// ...
}
​
function withdrawFees() external {
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
(bool success,) = feeAddress.call{value: feesToWithdraw}("");
require(success, "PuppyRaffle: Failed to withdraw fees");
}

Risk

Likelihood:

  • Each raffle with a large number of players generates significant fees

  • After sufficient raffles, the cumulative totalFees will exceed 2^64 - 1 (~18.4 ETH)

  • Modern raffles with thousands of players will trigger this quickly

Impact:

  • Fees are silently lost in the truncation

  • withdrawFees will fail because address(this).balance > uint256(totalFees)

  • Owner cannot withdraw accumulated fees, leaving funds permanently stuck

  • Protocol becomes insolvent relative to recorded obligations

Proof of Concept

// Scenario: raffle with 1000 players at 1 ETH each
// totalAmountCollected = 1000 ETH
// fee = (1000 * 20) / 100 = 200 ETH
// uint64 max = 18,446,744,073,709,551,615 wei ≈ 18.4 ETH
// After 92+ such raffles:
// totalFees (stored) = totalFees_old (uint64) + 200 ETH (cast to uint64)
// Overflow occurs, totalFees wraps to a small number
// withdrawFees check: address(this).balance (1000+ ETH) != totalFees (small number) → reverts
// Funds are stuck

Recommended Mitigation

- uint64 public totalFees = 0;
+ uint256 public totalFees = 0;
​
function selectWinner() external {
// ... winner selection logic ...
uint256 totalAmountCollected = players.length * entranceFee;
uint256 prizePool = (totalAmountCollected * 80) / 100;
uint256 fee = (totalAmountCollected * 20) / 100;
totalFees = totalFees + fee; // No cast needed
// ...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 8 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!