First Flight #5: Santa's List

Summary

Everyone who run test will be pwned

Vulnerability Details

testPwned function in test/unit/SantasListTest.t.sol inserts malicious file

Impact

private key lose, fund lose, harm users...

* Note: I am not sure how to do a PoC of this one. As it's not in a scope I am not sure is it a finding. But certainly is very harmful

Tools Used

Manually

Recommendations

Remove testPwned function from SantasListTest.t.sol before running tests