Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

As per the Documentation whereby these contracts should be able to be re-used with different collateral this finding should be pointed out that not using Foundry can result in compilation artefacts not containing one of the contracts that share the duplicate name of DSCEngineTest, and the tests possibly not running against the code in the src folder in scope

DSCEngineTest is re-used as a Contract Name in the two files mentioned below:

• DSCEngineTest (test/unit/DSCEngineTest.t.sol) on line 18

• DSCEngineTest (test/unit/OracleLibTest.t.sol) on line 10

Vulnerability Details

The tests do run and are effective in the current version of Foundry
Foundry outputs are folder based, as per the filename used, including the artefacts within, saved as the Contract Name.

https://github.com/crytic/slither/wiki/Detector-Documentation#name-reused

Impact

forge displays results of only the first test case, older version of Forge, not current
https://github.com/foundry-rs/foundry/issues/392
script duplicate names and compilation issues
https://github.com/foundry-rs/foundry/issues/3177

Tools Used

forge 0.2.0 (2d87c0c 2023-08-04T00:27:04.410646000Z)
Slither

Recommendations

Rename the Contract:

Edit Line 10 of OracleLibTest.sol as follows:

• contract DSCEngineTest is StdCheats, Test {

• contract OracleLibTest is StdCheats, Test {