First Flight #6: Voting Booth

Summary

The foundry ffi cheatcode is enabled. This can be dangerous. In this project a test function runs malicious code on the developers device.

Vulnerability Details

In foundry.toml ffi = true. In the mocks folder, ffi signature present. In the test file, a function called testPwned produces a string "youve-been-pwned-remember-to-turn-off-ffi!"

Impact

This could result in auditors or protocol developers running malicious code on their own devices. And could lead to loss of trust in the protocol and one's personal device.

Per the Foundry Book:

"Warning: Enabling this cheatcode has security implications for your project, as it allows tests to execute arbitrary programs on your computer."

More can be found here: https://book.getfoundry.sh/reference/config/testing#ffi

Tools Used

Manual inspection.

Recommendations

Disable the ffi cheatcode. Be cautious downloading open source code from GitHub to your personal device.