First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Improper logic in feedHorse() will make it fail at random times

ceseshi

Summary

The FEED_HORSE macro has a condition to check if the block timestamp is a multiple of 17, and reverts in that case. This is improper behaviour and should be removed.

Vulnerability Details

This code is incorrect and should be removed.

#define macro FEED_HORSE() = takes (0) returns (0) {
timestamp // [timestamp]
0x04 calldataload // [horseId, timestamp]
STORE_ELEMENT(0x00) // []
​
// End execution
@> 0x11 timestamp mod
@> endFeed jumpi
@> revert
@> endFeed:
stop
}

Impact

The feedHorse function will fail randomly, breaking the rule that horses must be able to be fed at all times.

Tools Used

Foundry, Manual review

Proof of Concept

This is a test that feeds a horse with a block.timestamp that will pass, and feeds the horse again with another block.timestamp expected to fail.

function testFeedOnInvalidTimestamp() public {
vm.warp(horseStore.HORSE_HAPPY_IF_FED_WITHIN());
horseStore.mintHorse();
​
// This will pass
vm.warp(block.timestamp - block.timestamp % 0x10);
horseStore.feedHorse(0);
​
// This will fail
vm.warp(block.timestamp - block.timestamp % 0x11);
vm.expectRevert();
horseStore.feedHorse(0);
}

Run Huff test

forge test --mc HorseStoreHuff --mt testFeedOnInvalidTimestamp

Test passes, confirming that the second feed reverts.

Running 1 test for test/HorseStoreHuff.t.sol:HorseStoreHuff
[PASS] testFeedOnInvalidTimestamp() (gas: 104974)

Recommended Mitigation

Remove the incorrect condition in FEED_HORSE.

timestamp // [timestamp]
0x04 calldataload // [horseId, timestamp]
STORE_ELEMENT(0x00) // []
​
// End execution
- 0x11 timestamp mod
- endFeed jumpi
- revert
- endFeed:
stop
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

FEED_HORSE() macro does not allow users to feed a horse if the timestamp is divisible by 17

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.