Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`uint64 totalFees` overflows/truncates under Solidity 0.7.6 and permanently strands fees

chapma26

Description

  • totalFees accumulates the 20% fee from each raffle so it can later be withdrawn to feeAddress.

  • It is stored as uint64 (max 2^64 - 1 ≈ 18.45 ETH), and fee (a uint256) is cast down with uint64(fee). Under 0.7.6 there are no overflow checks, so the cast truncates any single fee above the ceiling and the addition wraps once cumulative fees cross it — recording far less than was actually collected.

@> uint64 public totalFees = 0; // max ~18.45 ETH
...
uint256 fee = (totalAmountCollected * 20) / 100; // uint256, can exceed uint64 max
@> totalFees = totalFees + uint64(fee); // silent truncation + wrap

Risk

Likelihood:

  • When a single raffle's 20% fee exceeds ~18.45 ETH (e.g. 93+ players at a 1 ETH entrance fee).

  • When fees accumulated across successive raffles cross the same uint64 ceiling.

Impact:

  • Fees above the ceiling vanish from the accounting.

  • withdrawFees only ever pays out totalFees, so the untracked ETH is permanently locked in the contract, unrecoverable by anyone.

Proof of Concept

function testTotalFeesOverflowTruncatesFees() public {
uint256 numPlayers = 93;
address[] memory players = new address[](numPlayers);
for (uint256 i = 0; i < numPlayers; i++) {
players[i] = address(uint160(i + 100));
}
puppyRaffle.enterRaffle{value: entranceFee * numPlayers}(players);
​
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
puppyRaffle.selectWinner();
​
uint256 expectedFee = (numPlayers * entranceFee * 20) / 100; // 18.6 ETH
uint256 recordedFee = uint256(puppyRaffle.totalFees()); // ~0.153 ETH
assertLt(recordedFee, expectedFee);
}

Verified: expectedFee = 18.6e18 wei but recordedFee = 153,255,926,290,448,384 wei (= 18.6 ETH − 2⁶⁴). ~18.45 ETH is stranded.

Recommended Mitigation

- uint64 public totalFees = 0;
+ uint256 public totalFees = 0;
...
- totalFees = totalFees + uint64(fee);
+ totalFees = totalFees + fee;

Storing totalFees as uint256 removes both the cast and the packing limit. Upgrading to Solidity ≥0.8 additionally makes any future overflow revert instead of wrapping.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!