Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

uint64 overflow / unsafe cast of totalFees corrupts fee accounting and bricks withdrawFees

smurfetc

Description

  • Normally, totalFees should faithfully track the protocol fees so withdrawFees() can pay them out.

  • However, totalFees is a uint64 and is updated with totalFees = totalFees + uint64(fee) under Solidity 0.7.6 (no overflow checks). The uint64(fee) cast truncates large fees, and the uint64 addition wraps once accumulated fees exceed type(uint64).max (~18.45 ETH). totalFees then no longer equals the real ETH held, so withdrawFees()'s strict equality check can never pass and the fees are frozen forever.

uint64 public totalFees = 0; // line 30
...
uint256 fee = (totalAmountCollected * 20) / 100; // uint256, line 133
totalFees = totalFees + uint64(fee); // line 134: truncating cast + wrapping add (0.7.6)
...
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!"); // line 158

Risk

Likelihood: Medium

  • Reached when a single raffle's fee exceeds type(uint64).max, or when the cumulative uint64 sum wraps across multiple raffles. No special privileges are required.

Impact: High

  • Permanent loss/freeze of protocol fees and corrupted fee accounting: uint256(totalFees) != address(this).balance, so every call to withdrawFees() reverts.

Proof of Concept

Enter with enough players that fee = totalAmountCollected * 20 / 100 > type(uint64).max (truncation), or run multiple raffles so the cumulative uint64 sum wraps. After selectWinner(), uint256(totalFees) no longer equals address(this).balance, and withdrawFees() reverts on every call.

// conceptual: with entranceFee = 1e18 and ~93 players, fee = 18.6e18 > type(uint64).max (~18.44e18)
// totalFees = totalFees + uint64(18.6e18) // truncates -> totalFees < real fees
// withdrawFees(): require(address(this).balance == uint256(totalFees)) // reverts forever

Recommended Mitigation

Use uint256 for totalFees, remove the uint64 cast, and compile with Solidity >= 0.8 (or use SafeMath). In withdrawFees(), transfer the tracked amount directly instead of requiring address(this).balance == totalFees.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 8 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!