Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Overflow in `PuppyRaffle::totalFees` can lead to the permanent lock of funds in the contract

hackflu

[H-5] Overflow in PuppyRaffle::totalFees can lead to the permanent lock of funds in the contract

Description:
In solidity version prior to ^0.8.0 integers were subject to integer overflow and underflow

uint64 myVar = type(uint64).max;
// 18446744073709551615
myVar = myVar + 1;
// myVar will now be 0 due to overflow

Impact:
The overflow in PupppyRaffle::totalFees can lead to pay the incorrect amount of fees to the organizer and can lead to the permanent lock of funds in the contract.

Proof of Concept:

where 50 players in batch and another 50 players in another batch so that the PuppyRaffle::totalFees variable will exceed the maximum vlaue of uint64

Code
function testOverFlowinSelectWinnerFunc() public {
address[] memory players = new address[](50);
for(uint256 i = 0; i < 50;i++){
players[i] = address(uint160(i));
}
console.log("Current TotalFees : ",puppyRaffle.totalFees());
console.log("total entranc fee value of 50 players : ",entranceFee * 50);
puppyRaffle.enterRaffle{value: entranceFee * 50}(players);
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
puppyRaffle.selectWinner();
uint256 firstBatchTotalFee = puppyRaffle.totalFees();
emit log_named_uint("Current TotalFees at first batch : ",firstBatchTotalFee);
console.log("Current TotalFees After second Batch : ",puppyRaffle.totalFees());
​
address[] memory players2 = new address[](50);
for(uint256 i = 0; i < 50;i++){
players2[i] = address(uint160(i));
}
puppyRaffle.enterRaffle{value: entranceFee * 50}(players2);
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
puppyRaffle.selectWinner();
uint256 secondBatchTotalFee = puppyRaffle.totalFees();
console.log("Current TotalFees at second : ",secondBatchTotalFee);
}

once the PuppyRaffle::totalFees variable exceed the maximum value of uint64, it will overflow and the value will be incorrect.As the result the asset get locked in the contract because of the logic in line Line: 231 which check the balance of the contract with the PuppyRaffle::totalFees variable before allowing the organizer to withdraw the fees.

require(
address(this).balance == uint256(totalFees),
"PuppyRaffle: There are currently players active!"
);

Although you could we seldestruct to recover the funds, but it is not a recommended solution as it can lead to the loss of funds for the players who are currently active in the raffle.

Recommended Mitigation:
The Recommended Metigation are:

  1. use higher solidity version greater than ^0.8.0

  2. use uint256 instead of uint64 for PuppyRaffle::totalFees variable to prevent overflow and ensure that all fees can be accurately tracked and withdrawn.

  3. You can use the SafeMath library to perform safe arithmetic operations and prevent overflow in older versions of Solidity.

  4. Remove that check in line Line: 231 which check the balance of the contract with the PuppyRaffle::totalFees variable before allowing the organizer to withdraw the fees because it is not necessary and it can lead to the permanent lock of funds in the contract.

- require(address(this).balance == uint256(totalFees),"PuppyRaffle: There are currently players active!");
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 8 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!