Root + Impact

Description

• Users participate in the raffle; winners receive their entitled prizes, and the prize amounts will not be miscalculated.

• When the value of fee exceeds type(uint64).max, using uint64(fee) will truncate the higher bits, causing the fee to decrease, resulting in a loss.

• type(uint64).max can represent up to 18.5 ETH; if entranceFee == 1 ETH, then with roughly 93 participants the fee will begin to decrease.

Risk

Likelihood:

• After calculation, when entranceFee is set to 1 ETH, only 93 participants are needed for uint64(fee) to be truncated and its value reduced. Therefore, the larger the entranceFee is set, the fewer participants are required for uint64(fee) to overflow, causing a loss of funds.

• 
  

Impact:

• The totalFees amount decreases, the funds will be permanently locked in the contract.

• address(this).balance and uint256(totalFees) are unlikely to be equal

Proof of Concept

1. entranceFeeequal 1e18.

2. Initialize 100 players.

3. selectWinner()

4. Compare Expected Total Fees and Actual Total Fees.

5. withdrawFees()

6. expectRevert

   
   
   function test_Poc_TotalFeesOverflow() public {

   // 1. Simulate 100 players entering the raffle, each paying entranceFee

   address[] memory players = new address[](100);

   for (uint256 i = 0; i < 100; i++) {

   players[i] = address(i + 1);

   }

   puppyRaffle.enterRaffle{value: entranceFee * 100}(players);

   ​

   // 2. Time passes, raffle ends

   vm.warp(block.timestamp + duration + 1);

   vm.roll(block.number + 1);

   ​

   // 3. Select a winner, triggering totalFees update

   puppyRaffle.selectWinner();

   ​

   // 4. Check whether totalFees overflows

   uint256 expectedTotalFees = (entranceFee * 100 * 20) / 100;

   ​

   console.log("Expected total fees: ", uint256(expectedTotalFees));

   console.log("Actual total fees: ", uint256(puppyRaffle.totalFees()));

   console.log("Actual balance: ", address(puppyRaffle).balance);

   assertLt(puppyRaffle.totalFees(), uint256(expectedTotalFees));

   ​

   vm.expectRevert("PuppyRaffle: There are currently players active!");

   puppyRaffle.withdrawFees();

   }

Recommended Mitigation

1. Change the type of totalFees to uint256

2. uint64(fee) => fee