Submission Details
Severity:
Malicious mapping to solmate-bad inside foundry.toml
Summary
Inside the remappings section of foundry.toml, we see that:
remappings = [
'@openzeppelin/contracts=lib/openzeppelin-contracts/contracts',
'@solmate=lib/solmate-bad', <----------------------
]
Vulnerability Details
While in the current implementation, solmate libraries are not being used, anyone attempting to integrate it later might inadvertently be pointing to a malicious/bad implementation of solmate and cause unforeseen vulnerabilities. The 'bad' solmate can even be used to steal user funds.
Impact
Marking this as low because no immediate impact as per current implementation, but issues may arise in future.
Tools Used
Manual inspection.
Recommendations
Remove the mappings for any unused libraries.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.