First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect evaluation in `IS_HAPPY_HORSE` macro

0xtheblackpanther

Summary

There is an issue in the inline assembly code within the IS_HAPPY_HORSE macro. The current code fails to correctly handle the case where timestamp is equal to horseFedTimestamp, resulting in an incorrect return value.

Vulnerability Details

The issue arises in the following portion of the code:

eq // [timestamp == horseFedTimestamp]
start_return_true jumpi // [timestamp, horseFedTimestamp]

The code incorrectly jumps to the start_return_true label only if timestamp is not equal to horseFedTimestamp, leading to an incorrect result when they are equal.

Impact

This vulnerability could lead to incorrect evaluation of whether a horse is happy or not. In particular, when timestamp matches horseFedTimestamp, the current code incorrectly returns false, contrary to the expected behavior.

Tools Used

Manual review.

Recommendations

It is recommended to modify the code to handle the case where timestamp is equal to horseFedTimestamp correctly.

Update code will look like this:

#define macro IS_HAPPY_HORSE() = takes (0) returns (0) {
0x04 calldataload // [horseId]
LOAD_ELEMENT(0x00) // [horseFedTimestamp]
timestamp // [timestamp, horseFedTimestamp]
dup2 dup2 // [timestamp, horseFedTimestamp, timestamp, horseFedTimestamp]
sub // [timestamp - horseFedTimestamp, timestamp, horseFedTimestamp]
[HORSE_HAPPY_IF_FED_WITHIN_CONST] // [HORSE_HAPPY_IF_FED_WITHIN, timestamp - horseFedTimestamp, timestamp, horseFedTimestamp]
dup2 // [HORSE_HAPPY_IF_FED_WITHIN, timestamp - horseFedTimestamp, timestamp, horseFedTimestamp, timestamp - horseFedTimestamp]
eq // [HORSE_HAPPY_IF_FED_WITHIN == timestamp - horseFedTimestamp, timestamp, horseFedTimestamp]
start_return_true jumpi // [timestamp, horseFedTimestamp]
eq // [timestamp == horseFedTimestamp, timestamp, horseFedTimestamp]
start_return_true jumpi // [timestamp, horseFedTimestamp]
0x00 // [0, timestamp, horseFedTimestamp]
start_return_true:
​
start_return:
// Store value in memory.
0x00 mstore
​
// Return value
0x20 0x00 return
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.