Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Integer overflow of `PuppyRaffle::totalFees` loses fees

lukamm

Root + Impact

Description

In Solidity versions prior to 0.8.0 integers were subject to integer overflows.

uint64 myVar = type(uint64).max
// 18446744073709551615
myVar = myVar + 1
// myVar will be 0

Risk

Likelihood:

This will occur when the fee calculated in PuppyRaffle::selectWinner is added to the totalFees variable and the total is greater than the max value for a uint64

Impact:

In PuppyRaffle::selectWinner, totalFees are accumulated for the feeAddress to collect later in PuppyRaffle::withdrawFees. However, if the totalFees variable overflows, the feeAddress may not collect the correct amount of fees and they can be stuck in the contract.

Proof of Concept

  1. Players enter the raffle

  2. The total fees generated are higher than the max value for a uint64

  3. Select winner is called and the fee is added to totalFees

totalFees = totalFees + uint64(fee);

  1. As fee plus the current totalFees is higher than the max value of a uint64 it will overflow and the returned value will be incorrect.

Place the following test into PuppyRaffleTest.t.sol

function testSelectWinnerOverflow() public {
uint256 initialTotalFees = puppyRaffle.totalFees();
uint256 playersNum = 100;
// Enter players
address[] memory players = new address[](playersNum);
for (uint256 i = 0; i < playersNum; i++) {
players[i] = address(i + 89);
}
puppyRaffle.enterRaffle{value: entranceFee * playersNum}(players);
​
// warp to after the duration
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
​
// Select winner
puppyRaffle.selectWinner();
​
// Check total fees
uint256 expectedTotalFees = ((initialTotalFees + entranceFee * playersNum) * 20) / 100;
uint256 actualTotalFees = puppyRaffle.totalFees();
​
// Check overflow
console.log("expected total fees:", expectedTotalFees);
console.log("actual total fees:", actualTotalFees);
assertLt(actualTotalFees, expectedTotalFees);
assertEq(expectedTotalFees % (uint256(type(uint64).max) + 1), actualTotalFees);
}

Recommended Mitigation

Use a newer version of solidity, and a uint256 instead of a uint64 for PuppyRaffle::totalFees

- pragma solidity ^0.7.6
+ pragma solidity 0.8.0
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 3 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!