Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Integer Truncation and Overflow in `PuppyRaffle::totalFees` Causes Permanent Loss and Lockup of Protocol Revenue

farhandavin14

[H-03] Integer Truncation and Overflow in PuppyRaffle::totalFees Causes Permanent Loss and Lockup of Protocol Revenue

Description

  • The protocol collects a 20% fee from all entrance funds each round, accumulating the amount in totalFees to be withdrawn by the protocol owner.

  • totalFees is declared as a uint64, whereas fee calculations produce uint256 numbers in wei. Casting uint64(fee) truncates values whenever the fee exceeds type(uint64).max (~18.4467 ETH), and in Solidity 0.7.6 arithmetic operations on uint64 overflow silently without reverting, causing the recorded fee to become corrupted and significantly lower than actual funds.

// Storage packing uint64
@> uint64 public totalFees = 0;
...
function selectWinner() external {
...
uint256 totalAmountCollected = players.length * entranceFee;
uint256 fee = (totalAmountCollected * 20) / 100;
@> totalFees = totalFees + uint64(fee);
...
}

Risk

Likelihood:

  • A raffle round collects more than ~92.23 ETH (e.g. 93 players with 1 ETH fee produces 18.6 ETH fee, exceeding type(uint64).max).

  • Repeated raffle rounds accumulate fees over time until the cumulative total surpasses $2^{64}-1$.

Impact:

  • Severe loss of protocol revenue because excess bits are permanently discarded by truncation.

  • withdrawFees() permanently reverts on the strict equality check require(address(this).balance == uint256(totalFees)) because address(this).balance exceeds the truncated totalFees.

Proof of Concept

function testTotalFeesTruncationAndOverflow() public {
// 100 players enter with 1 ETH each -> 100 ETH collected
// Expected 20% fee = 20 ETH (20e18 wei), which exceeds type(uint64).max (18.44e18 wei)
uint256 numPlayers = 100;
address[] memory players = new address[](numPlayers);
for (uint256 i = 0; i < numPlayers; i++) {
players[i] = address(uint160(i + 1));
vm.deal(players[i], 1 ether);
vm.prank(players[i]);
address[] memory single = new address[](1);
single[0] = players[i];
puppyRaffle.enterRaffle{value: 1 ether}(single);
}
​
vm.warp(block.timestamp + duration + 1);
puppyRaffle.selectWinner();
​
uint256 expectedFee = 20 ether;
uint64 actualTotalFees = puppyRaffle.totalFees();
​
// 20e18 % 2^64 = 1.553255926290448384 ether (~1.55 ETH instead of 20 ETH)
assertLt(actualTotalFees, expectedFee);
console.log("Expected Fee:", expectedFee);
console.log("Actual Fee recorded:", uint256(actualTotalFees));
}

Recommended Mitigation

- uint64 public totalFees = 0;
+ uint256 public totalFees = 0;
...
function selectWinner() external {
...
uint256 fee = (totalAmountCollected * 20) / 100;
- totalFees = totalFees + uint64(fee);
+ totalFees = totalFees + fee;
...
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-05] Typecasting from uint256 to uint64 in PuppyRaffle.selectWinner() May Lead to Overflow and Incorrect Fee Calculation

## Description ## Vulnerability Details The type conversion from uint256 to uint64 in the expression 'totalFees = totalFees + uint64(fee)' may potentially cause overflow problems if the 'fee' exceeds the maximum value that a uint64 can accommodate (2^64 - 1). ```javascript totalFees = totalFees + uint64(fee); ``` ## POC <details> <summary>Code</summary> ```javascript function testOverflow() public { uint256 initialBalance = address(puppyRaffle).balance; // This value is greater than the maximum value a uint64 can hold uint256 fee = 2**64; // Send ether to the contract (bool success, ) = address(puppyRaffle).call{value: fee}(""); assertTrue(success); uint256 finalBalance = address(puppyRaffle).balance; // Check if the contract's balance increased by the expected amount assertEq(finalBalance, initialBalance + fee); } ``` </details> In this test, assertTrue(success) checks if the ether was successfully sent to the contract, and assertEq(finalBalance, initialBalance + fee) checks if the contract's balance increased by the expected amount. If the balance didn't increase as expected, it could indicate an overflow. ## Impact This could consequently lead to inaccuracies in the computation of 'totalFees'. ## Recommendations To resolve this issue, you should change the data type of `totalFees` from `uint64` to `uint256`. This will prevent any potential overflow issues, as `uint256` can accommodate much larger numbers than `uint64`. Here's how you can do it: Change the declaration of `totalFees` from: ```javascript uint64 public totalFees = 0; ``` to: ```jasvascript uint256 public totalFees = 0; ``` And update the line where `totalFees` is updated from: ```diff - totalFees = totalFees + uint64(fee); + totalFees = totalFees + fee; ``` This way, you ensure that the data types are consistent and can handle the range of values that your contract may encounter.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!