Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unsafe uint64 cast / overflow of totalFees causes protocol fees to be lost

thxmxx

Root + Impact

Description

  • Normally, each selectWinner call should credit 20% of the round's funds to totalFees, so withdrawFees can later pay the fee address exactly what was collected.

  • totalFees is a uint64 and the contract is compiled with Solidity 0.7.6, which has no built-in overflow checks. totalFees = totalFees + uint64(fee) truncates fee when it exceeds type(uint64).max (~18.45 ETH) and can also overflow on accumulation. Either way totalFees stops matching the real fees, permanently corrupting fee accounting.

@> uint64 public totalFees = 0;
// ...
uint256 fee = (totalAmountCollected * 20) / 100;
@> totalFees = totalFees + uint64(fee); // uint64 cast truncates; 0.7.6 has no overflow guard

Risk

Likelihood:

  • Happens in any round where the 20% fee exceeds ~18.45 ETH (e.g., 100 players at a 1 ETH entrance fee = 20 ETH fee), since the uint64 cast truncates the value.

  • Happens cumulatively as totalFees grows across rounds and wraps past type(uint64).max.

Impact:

  • Fees are under-counted and effectively lost; the gap between the real fee and the truncated totalFees becomes unwithdrawable.

  • Because withdrawFees requires address(this).balance == uint256(totalFees), once they diverge fee withdrawal reverts permanently.

Proof of Concept

Foundry test: 100 players at a 1 ETH entrance fee make the 20% fee = 20 ETH, exceeding uint64 max. After selectWinner, totalFees records only ~1.55 ETH instead of 20 ETH — ~18.45 ETH lost.

// 100 players, fee = 20 ETH > type(uint64).max (~18.45 ETH)
raffle.enterRaffle{value: 1 ether * 100}(players);
vm.warp(block.timestamp + 2 days);
raffle.selectWinner();
​
uint256 realFee = (1 ether * 100 * 20) / 100; // 20 ETH
assertLt(raffle.totalFees(), realFee); // recorded < real
assertEq(raffle.totalFees(), uint256(uint64(realFee))); // truncated value

Recommended Mitigation

Use uint256 for totalFees and a checked compiler (>=0.8) or SafeMath; never downcast fee amounts.

- uint64 public totalFees = 0;
+ uint256 public totalFees = 0;
...
- totalFees = totalFees + uint64(fee);
+ totalFees = totalFees + fee;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 16 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!