Puppy Raffle

totalFees Overflow Causes Silent Loss of All Fee Revenue

Severity: Medium

Description

• The protocol accumulates a 20% fee from each raffle round into totalFees, which the owner withdraws via withdrawFees().

• totalFees is declared as uint64 with a maximum value of approximately 18.44 ETH. When the fee from a raffle round exceeds this, the unsafe cast uint64(fee)
  silently wraps to near-zero. In Solidity 0.7.6 there is no automatic overflow protection, so no revert occurs and no event is emitted.

// @> totalFees declared as uint64 — max ~18.44 ETH
uint64 public totalFees = 0;

function selectWinner() external {
uint256 fee = (totalAmountCollected * 20) / 100;
// @> uint256 fee silently truncated to uint64
// @> 93 players @ 1 ETH = 18.6 ETH fee -> overflows, stored as 0.15 ETH
totalFees = totalFees + uint64(fee);
}

Risk

Likelihood:

• The overflow triggers with as few as 93 players at 1 ETH entrance fee — a realistic participation level for any active raffle round.

• The overflow is completely silent — no revert, no event, no indication that fee accounting is broken.

Impact:

• The protocol owner permanently loses the majority of fee revenue with no recovery mechanism.

• withdrawFees() succeeds but sends only the small wrapped value instead of actual fees earned.

Proof of Concept

With 100 players at 1 ETH each, the 20 ETH fee exceeds uint64 max and wraps to approximately 1.55 ETH. The owner calls withdrawFees() successfully but receives
only a fraction of the actual fees:

function test_TotalFees_Overflow() public {
uint256 numPlayers = 100;
address[] memory players = new address;
for (uint256 i = 0; i < numPlayers; i++)
players[i] = address(uint160(100 + i));
vm.deal(address(this), entranceFee * numPlayers);
raffle.enterRaffle{value: entranceFee * numPlayers}(players);
vm.warp(block.timestamp + duration + 1);
raffle.selectWinner();

  uint64 stored = raffle.totalFees();                                                                                                                         
  uint256 expected = (100 * entranceFee * 20) / 100;                                                                                                        
  assertLt(uint256(stored), expected);                                                                                                                        

}

Recommended Mitigation

Change totalFees to uint256 to match the type of the fee calculation and eliminate the unsafe cast entirely:

• uint64 public totalFees = 0;

• uint256 public totalFees = 0;

• totalFees = totalFees + uint64(fee);

• totalFees = totalFees + fee;