Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

totalFees uses an unsafe uint64 accumulator and can overflow, locking protocol fees

sonicthealpha

Root + Impact

Description

  • The contract stores cumulative fees in totalFees, but the variable is declared as uint64.

  • In Solidity 0.7.6, arithmetic and narrowing conversions do not automatically revert on overflow.

  • selectWinner() computes fee as a uint256 and then adds uint64(fee) into totalFees.

  • Once cumulative fees exceed 2^64 - 1, the accumulator wraps, causing totalFees to no longer represent the real fee balance held by the contract.

  • Because withdrawFees() requires address(this).balance == uint256(totalFees), the mismatch can permanently block fee withdrawals.

address public feeAddress;
@> uint64 public totalFees = 0;
​
function selectWinner() external {
...
uint256 fee = (totalAmountCollected * 20) / 100;
@> totalFees = totalFees + uint64(fee);
...
}
​

Risk

Likelihood:

  • The issue becomes reachable over time as the protocol accumulates enough raffle volume.

  • No attacker privilege is needed beyond normal participation.

Impact:

  • Protocol fees can become permanently unwithdrawable.

  • Internal accounting drifts away from actual funds held by the contract.

Proof of Concept

// 1. The raffle runs repeatedly and accumulates fees over time
// 2. totalFees eventually exceeds the uint64 maximum
// 3. The cast and addition wrap in Solidity 0.7.6
// 4. totalFees no longer equals the actual fee balance in the contract
// 5. withdrawFees() reverts because the strict equality check can never pass
​

Recommended Mitigation

Using SafeMath for Solidity 0.7 arithmetic is also recommended if the contract remains on this compiler version.

address public feeAddress;
-uint64 public totalFees = 0;
+uint256 public totalFees = 0;
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!