Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Integer overflow of `PuppyRaffle::totalFees` loses fees.

strikerr

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

**Description:** In solidity versions prior to `0.8.0` integers were subjected to integer overflows.
```solidity
uint64 myVar = type(64).max
//18446744073709551615
myVar = myVar + 1
//myVar will be 0
```

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

**Proof of Concept:** Proof of code
1. we conclude a raffle of 4 players.
2. we then have 89 players enter a new raffle, and conclude the raffle.
3. `totalFees` will be:
```solidity
totalFees = totalFees + uint64(fee);
//aka
totalFees = 8000000000000000000 + 178000000000000000
// an this will overflow
totalFees = xxxxxxxxxxxxxxxxxx
```
4. you will not be able to withdraw, due to the line in `PuppyRaffle::withdrawFees`
```solidity
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
```
​
Although you could use `selfDestruct` to send ETH to this contract in order for the values to match and withdraw the fees, this is clearly not the intended design of the protocol. At some point there will be too much balance in the contract that the above will be impossible to hit.
​
<details>
<summary>code</summary>
​
```solidity
function testOverFlow() public {
address[] memory players1 = new address[](60);
for(uint256 i = 0; i < 60; ++i) {
players1[i] = address(i + 1);
}
puppyRaffle.enterRaffle{value: entranceFee * players1.length}(players1);
// We finish a raffle of 4 to collect some fees
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
puppyRaffle.selectWinner();
uint256 startingTotalFees = puppyRaffle.totalFees();
​
address[] memory players = new address[](90);
for(uint256 i = 0; i < 90; ++i) {
players[i] = address(i + 60);
}
puppyRaffle.enterRaffle{value: entranceFee * players.length}(players);
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
puppyRaffle.selectWinner();
uint256 totalAmountCollected = players.length * entranceFee;
uint256 actualFee = (totalAmountCollected * 20) / 100;
uint256 endingTotalFees = puppyRaffle.totalFees();
assertGt(actualFee, endingTotalFees);
assertGt(startingTotalFees, endingTotalFees);
console.log("actualFee:", actualFee);
console.log("totalFees(overFlowed):", endingTotalFees);
}
```
​
</details>

Recommended Mitigation

**Recommended Mitigation:** There are a few po
1. Use a newer version of solidity, and a `uint256` instead of `uint64` for `PuppyRaffle::totalFees`
2. you could use a `safeMath` library of Openzeppelin for version 0.7.6 of solidity, however you'll have a hard time with the `uint64` type if too many fees are collected.
3. remove the balance check from `PuppyRaffle::withdrawFees`
​
```diff
- require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
```
There are more attack vectors with that final require, so we recommend removing it regardless.
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!