Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Integer Overflow in totalFees Causes Lost Funds

ravigaikar88

Root + Impact

Description

  • The totalFees variable is declared as uint64 but the fee calculation in selectWinner() uses uint256. When casting from uint256 to uint64, if the fee amount exceeds 2^64-1 (approximately 18.4 ETH), an overflow occurs and totalFees wraps around to a small value. This causes permanent loss of funds as the actual contract balance will be much higher than the recorded totalFees, making those funds unwithdrawable. Additionally, Solidity 0.7.6 lacks automatic overflow protection.

// Root cause
function selectWinner() external {
uint256 totalAmountCollected = players.length * entranceFee;
uint256 prizePool = (totalAmountCollected * 80) / 100;
uint256 fee = (totalAmountCollected * 20) / 100;
totalFees = totalFees + uint64(fee);
}

Risk

Likelihood:

  • In selectWinner(), the protocol calculates raffle fees as 20% of the total amount collected. This value is stored in a uint256, but then cast to uint64 when added to totalFees.

Impact:

  • When the cumulative fees exceed ~18.4 ETH, the totalFees variable overflows, permanently locking funds in the contract. These funds become unrecoverable as withdrawFees() relies on totalFees to determine the withdrawal amount.

    • totalFees overflows once cumulative fees exceed ~18.4 ETH

    • Recorded fees become much smaller than actual fees held

    • Excess ETH becomes permanently unwithdrawable

    • Funds are irreversibly locked inside the contract

Proof of Concept

Preconditions

  • totalFees is declared as uint64

  • entranceFee = 1 ether

  • Fee percentage = 20%

  • Solidity version < 0.8.0 (no automatic overflow checks)

1// Assuming entranceFee = 1 ether
2// After multiple raffles with 100 players each:
3// Each raffle generates: 100 * 1 ether * 20% = 20 ether in fees
4// After just 1 raffle with 100 players:
5// fee = 20 ether = 20 * 10^18 wei
6// uint64 max = 2^64 - 1 = 18,446,744,073,709,551,615
7// 20 * 10^18 = 20,000,000,000,000,000,000
8// This exceeds uint64 max, causing overflow
9// totalFees = uint64(20 * 10^18) = 1,553,255,926,290,448,384
10// Actual fees: 20 ETH, Recorded fees: ~1.55 ETH
11// Lost funds: ~18.45 ETH

Recommended Mitigation

ETH-denominated values should always use uint256.

// Option 1: Change totalFees to uint256
address public feeAddress;
uint256 public totalFees = 0; // Changed from uint64 to uint256
​
// Option 2: Add overflow check
function selectWinner() external {
// ...
uint256 fee = (totalAmountCollected * 20) / 100;
require(fee <= type(uint64).max - totalFees, "Fee overflow");
totalFees = totalFees + uint64(fee);
// ...
}
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!