Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

H-3: Integer overflow on totalFees (uint64) silently loses protocol revenue

0xjjjjjj

Description

Severity: High

At PuppyRaffle.sol:30, totalFees is declared as uint64:

uint64 public totalFees = 0;

At PuppyRaffle.sol:134, a uint256 fee value is unsafely downcast to uint64:

totalFees = totalFees + uint64(fee);

The fee variable is a uint256 computed as (totalAmountCollected * 20) / 100. The explicit cast uint64(fee) silently truncates any value above 2^64 - 1 (~18.44 ETH in wei). Since Solidity 0.7.6 does not have built-in overflow protection, the addition also wraps silently.

With an entrance fee of 1 ETH and 100 players: fee = 20 ETH, but uint64(20e18) truncates to ~1.55 ETH. The protocol loses ~18.45 ETH of fees in a single round.

Proof of Concept

function testOverflowTotalFees() public {
uint256 playerCount = 100;
address[] memory entrants = new address[](playerCount);
for (uint256 i = 0; i < playerCount; i++) {
entrants[i] = address(uint160(i + 10));
}
puppyRaffle.enterRaffle{value: entranceFee * playerCount}(entrants);
​
vm.warp(block.timestamp + duration + 1);
puppyRaffle.selectWinner();
​
// fee = 100 * 1e18 * 20 / 100 = 20e18
// uint64(20e18) = 20000000000000000000 % 2^64 = 1553255926290448384
// Lost: ~18.44 ETH silently truncated
uint64 totalFees = puppyRaffle.totalFees();
assert(totalFees < 20 ether); // proves truncation occurred
}

Risk

  • Impact: High — permanent, irrecoverable loss of protocol fee revenue. Fees are silently truncated on every round with significant participation.

  • Likelihood: High — occurs naturally as fees accumulate. No attacker needed.

Recommended Mitigation

Change totalFees from uint64 to uint256 at PuppyRaffle.sol:30 and remove the unsafe cast at PuppyRaffle.sol:134:

// Before
uint64 public totalFees = 0;
totalFees = totalFees + uint64(fee);
​
// After
uint256 public totalFees = 0;
totalFees = totalFees + fee;

This changes the storage layout (the original uint64 was packed with feeAddress at line 29-30), but correctness must take priority over gas optimization.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!