Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-4] Integer Overflow in totalFees causes loss of protocol fees and permanent DoS

alenkte

Summary

The selectWinner function accumulates protocol fees into the totalFees variable. However, this variable is cast to uint64 before addition. In Solidity versions prior to 0.8.0, integers overflow without reverting. If the accumulated fees exceed type(uint64).max (~18.44 ETH), the value wraps around to a much smaller number. This causes two severe issues: the protocol loses the majority of its fees, and the withdrawFees function becomes permanently unusable (DoS) due to a strict equality check.

Vulnerability Details

The vulnerability exists in the selectWinner function where fees are added to totalFees:

​
// @audit-issue unsafe cast to uint64 allows overflow
totalFees = totalFees + uint64(fee);

Since PuppyRaffle uses Solidity 0.7.6, arithmetic operations do not automatically check for overflow. The maximum value of a uint64 is 18,446,744,073,709,551,615 (approximately 18.44 ETH).

If the fee (20% of the prize pool) plus the current totalFees exceeds this limit, the variable overflows. For example, if the calculated fee is 20 ETH, the stored totalFees will be 20 ETH - 18.44 ETH = 1.56 ETH.

This creates a logic error in withdrawFees:

​
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
The contract balance will hold the actual amount (20 ETH), but totalFees will hold the overflowed amount (1.56 ETH). Since 20 ETH != 1.56 ETH, the withdrawFees function will always revert, trapping all funds in the contract.

Proof of Concept

This test demonstrates that collecting fees larger than ~18.44 ETH causes an overflow and bricks the withdrawFees function.

Click to view Foundry PoC

function test_IntegerOverflowInSelectWinner() public {

// 1. Setup enough players to generate fees > type(uint64).max

// We need (totalCollected * 0.20) > 18.44 ETH

// 100 players * 1 ETH entrance fee = 100 ETH collected.

// 20% fees = 20 ETH (which is > 18.44 ETH)

uint256 playersNum = 100;
address[] memory players = new address[]();
for (uint256 i = 0; i

Recommended Mitigation

Use uint256 for totalFees: There is no significant gas saving from using uint64 in this context, and it introduces dangerous overflow risks.

Use SafeMath: Since the contract is using Solidity 0.7.6, use OpenZeppelin's SafeMath library for additions, or upgrade the contract to Solidity 0.8.0+ which handles overflows automatically.

​
- uint64 public totalFees = 0;
+ uint256 public totalFees = 0;
​
...
​
- totalFees = totalFees + uint64(fee);
+ totalFees = totalFees + fee;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!