[forumevi]

Problem

faucet(user_id, amount) accepts user_id as an explicit argument, so any caller can pass an arbitrary user ID. This creates two issues:

Griefing: an attacker calls faucet(victim_id, max_amount) to exhaust the victim's entire rate-limit window. The victim receives the tokens but cannot claim from the faucet again for 120 blocks, without having requested anything.

Window manipulation: an attacker calls faucet(victim_id, 1) at an arbitrary block to reset the victim's window_start_block, shifting the 120-block window to a time the victim did not choose.

In both cases the attack costs only a transaction fee.

Fix

Replace the user_id parameter with get_user_id(), which reads the authenticated caller ID from the execution context. The invoke_deferred call is unchanged — user_id now always refers to the actual caller.

-    pub fn faucet(user_id: Felt, amount: Felt) {
+    pub fn faucet(amount: Felt) {
+        let user_id = get_user_id();

Testing

Existing behavior is preserved for the normal case (caller claims for themselves). The griefing path is no longer reachable because user_id is fixed to the transaction signer.

[forumevi]

Note: the fix was verified by code review against the existing usage of get_user_id() in the same codebase (token/src/main.psy lines 279, 331, 415, 462) but was not compiled locally — the sandbox does not have a Rust toolchain. Happy to iterate if CI surfaces any issues.