Submission Details
Severity:
feedHorse() can feed horse NFT that does not exist and isHappyHorse() can show non-existent horses as happy
Summary
feedHorse() can feed horse NFT that does not exist and isHappyHorse() can show non-existent horses as happy
Vulnerability Details
It just uses a mapping of uint256 id to uint256 lastFedTimeStamp, and there are no check that the id exist as a horse NFT. So feedHorse() can feed a horse NFT that does not exist and isHappyHorse() will show the non-existent horse as happy
Impact
Feed horse NFT that does not exist and wrongly show non-existent horses as happy
Tools Used
Manual review
Recommendations
Check that the id exist as a horse NFT
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Nonexistent horses can be fed
Rewards breakdown
nSLOC
460This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.