Submission Details
Severity:
Arbitrary commands executed when running the test suite
Summary
Arbitrary commands executed when running the test suite
Vulnerability Details
The test testPwned uses the ffi cheatcode to create a file youve-been-pwned in the project directory. This is possible because ffi = true is enabled in the foundry.toml file. Although this time the command just created an empty file, this is a potential risk for developers as anyone who can change the tests of a project will be able to execute arbitrary commands on devices that run the tests
Impact
High
Tools Used
Manual Review
Recommendations
Remove the testPwned test and avoid using ffi cheatcode
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.