Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Fee accounting uses `uint64 totalFees` and truncates `fee`, which can overflow and lock withdrawals.

gush

Root + Impact

Description

  • In `PupplyRaffle::selectWinner` the fee is computed as `uint256 fee = (totalAmountCollected * 20) / 100;` but it is accumulated into `uint64 totalFees` via `totalFees = totalFees + uint64(fee);`.


    This downcast truncates the upper bits and in Solidity 0.7.x arithmetic does not revert on overflow. If fees ever exceed `type(uint64).max`, `totalFees` will wrap and become incorrect.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • When fees overflow the totalFees variable.

Impact:

  • Fee accounting becomes incorrect and `PuppyRaffle::withdrawFees()` can become permanently unusable, because it requires `address(this).balance == uint256(totalFees)`.

Proof of Concept

Place the following test into `PuppyRaffleTest.t.sol`.
​
```solidity
function test_totalFeesUint64Truncation_breaksWithdrawFees() public {
// 10 ether entrance fee, 10 players => total 100 ether
// fee = 20 ether, which is > type(uint64).max (~18.4 ether)
PuppyRaffle raffle = new PuppyRaffle(10 ether, address(123), 0);
​
address[] memory players = new address[](10);
for (uint256 i = 0; i < 10; i++) {
players[i] = address(uint160(i + 1));
}
​
vm.deal(address(this), 100 ether);
raffle.enterRaffle{value: 100 ether}(players);
​
// Draw winner (duration = 0)
raffle.selectWinner();
​
// Contract should hold exactly 20 ether in fees
assertEq(address(raffle).balance, 20 ether);
​
// But totalFees is uint64 and was truncated/wrapped
uint256 trackedFees = uint256(raffle.totalFees());
assertTrue(trackedFees != 20 ether);
​
// withdrawFees() now reverts because balance != totalFees
vm.expectRevert();
raffle.withdrawFees();
}
```

Recommended Mitigation

Change `totalFees` to `uint256` and remove the downcast.
​
```diff
- uint64 public totalFees = 0;
+ uint256 public totalFees = 0;
@@
- uint256 fee = (totalAmountCollected * 20) / 100;
- totalFees = totalFees + uint64(fee);
+ uint256 fee = (totalAmountCollected * 20) / 100;
+ totalFees = totalFees + fee;
```
​
If storage packing is desired, enforce a hard cap (revert if `fee` would not fit into `uint64`) and document it.
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!