The feedHorse
function in the HorseStore
contract allows updating the horseIdToFedTimeStamp[horseId]
for a given horseId
without verifying whether the horse with that horseId
has been minted. This oversight can lead to a violation of the specified invariant and inaccurate happiness checks in the isHappyHorse
function.
The issue arises in the feedHorse
function, where the horseId
is not checked for existence (minting) before updating the associated horseIdToFedTimeStamp[horseId]
. This oversight can result in misleading information, wasted gas, and a violation of the invariant.
Breaking Invariant:
This break the invariant because how can horse be happy if it is not present?
Misleading Information:
Feeding non-existent horses can result in inaccurate information about the state of horses, as horseIdToFedTimeStamp[horseId]
may be updated for non-existent horses.
Inconsistent State:
The contract may end up in an inconsistent state with certain horseId
values having associated timestamps but no corresponding horses.
Copy the below test code
Run it via this cmd forge test --match-test testStableMasterIsFeedingToGhostsInsteadOfHorses
Test code:
It will result in this:
Manual review.
Check Horse Existence:
Add a check in the feedHorse
function to ensure that the provided horseId
corresponds to a valid horse (exists) before updating the mapping.
e.g you can add a check like this to avoid this issue:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.