Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-1] Integer Overflow on `PuppyRaffle::SelectWinner()::fee`

scr1tty

Integer Overflow on PuppyRaffle::SelectWinner()::fee

Risk

Severity: High

Likelihood: High

Impact: High

Overall: High — triggers automatically under normal protocol usage
without any attacker involvement once 93+ players enter a single raffle.

Description

uint64 max value is 18,446,744,073,709,551,615 (~18.44 ETH in wei). Once fee exceeds this value — which occurs at approximately 93 players at the default 1 ETH entrance fee — the typecast silently truncates the value, causing totalFees to record a fraction of what was actually collected.

function selectWinner() external {
...
// relevant code goes here
// fee is originally declared as uint256
uint256 fee = (totalAmountCollected * 20) / 100;
totalFees = totalFees + uint64(fee); // type-casted to uint64
​
// relevant code goes here
...
}

Impact

The protocol owner permanently loses fee revenue. At 100 players, the contract owes 20 ETH in fees but records only ~1.75 ETH — a loss of ~18.44 ETH per raffle cycle. The truncated fees are unrecoverable as no mechanism exists to recalculate or correct totalFees.

Proof of Concept

function test_selectWinnerFeeOverflow() public {
// Generate players
address[] memory legitPlayers = new address[](100);
for (uint256 i = 0; i < 100; i++) {
legitPlayers[i] = address(uint160(i+1));
}
​
// Enter raffle with the players
puppyRaffle.enterRaffle{value: entranceFee * 100}(legitPlayers);
​
// Skip time to select winner
vm.warp(block.timestamp + puppyRaffle.raffleDuration() + 1);
puppyRaffle.selectWinner();
​
uint256 expectedFee = (entranceFee * 101 * 20) / 100;
uint256 actualFee = puppyRaffle.totalFees();
​
// Actual Fee < Expected Fee
assertLt(actualFee, expectedFee);
​
}

Test output:

[PASS] test_selectWinnerFeeOverflow() (gas: 5414150)

Recommended Mitigation

Changing totalFees from uint64 to uint256 eliminates the overflow entirely since uint256 can hold values up to ~1.15 × 10^77, far exceeding any realistic fee accumulation. Removing the explicit cast prevents silent truncation.

- uint64 public totalFees;
+ uint256 public totalFees;
​
- totalFees = totalFees + uint64(fee);
+ totalFees = totalFees + fee;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!