First Flight #7: Horse Store

Summary

The feedHorse function in the HorseStore contract allows updating the horseIdToFedTimeStamp[horseId] for a given horseId without verifying whether the horse with that horseId has been minted. This oversight can lead to a violation of the specified invariant and inaccurate happiness checks in the isHappyHorse function.

Vulnerability Details

The issue arises in the feedHorse function, where the horseId is not checked for existence (minting) before updating the associated horseIdToFedTimeStamp[horseId]. This oversight can result in misleading information, wasted gas, and a violation of the invariant.

Impact

1. Breaking Invariant:

   • This break the invariant because how can horse be happy if it is not present?

2. Misleading Information:

   • Feeding non-existent horses can result in inaccurate information about the state of horses, as horseIdToFedTimeStamp[horseId] may be updated for non-existent horses.

3. Inconsistent State:

   • The contract may end up in an inconsistent state with certain horseId values having associated timestamps but no corresponding horses.

POC

• Copy the below test code

• Run it via this cmd forge test --match-test testStableMasterIsFeedingToGhostsInsteadOfHorses

Test code:

It will result in this:

Tools Used

Manual review.

Recommendations

Check Horse Existence:

• Add a check in the feedHorse function to ensure that the provided horseId corresponds to a valid horse (exists) before updating the mapping.

e.g you can add a check like this to avoid this issue: