Malicious unit test can damage developer's machine
Summary
The repo contains a malicious unit test which can cause damage to a developer's machine if run
Vulnerability Details
The test suite is configured to allow ffior Foreign Function Interface. This allows foundry tests to make arbitrary calls to anything on the developer's system. While useful in some cases, it can lead to damage if a test calls something malicious. Currently one unit test, SantasListTest::testPwned creates a file on the system without the developer's consent.
Impact
Total pwnage
Tools Used
Manual review
Recommendations
Remove the malicious test and possible make developers aware of ffi calls in the README
Lead Judging Commences
test_pwned FFI vulnerability
The FFI variable within Foundry.TOML was set to TRUE. This variable gives foundry shell access and allows it to run commands on your terminal. The possibility of exploitation through this means are endless! This repo exploited this flag through test_pwned Keep an eye out before running tests!
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.