Submission Details
Severity:
The `feedHorse` lacks input validation, allowing anyone to feed any horse without checking ownership
Impact
The feedHorse function lacks input validation, allowing anyone to feed any horse without checking ownership. This could lead to unintended consequences, such as manipulating the feeding timestamp of horses that don't belong to the caller.
Proof of Concept
// In HorseStore.sol
// Original existing code snippet in feedHorse()
function feedHorse(uint256 horseId) external {
horseIdToFedTimeStamp[horseId] = block.timestamp;
}
Tools Used
Manual code analysis
Recommended Mitigation Steps
To address the lack of input validation in feedHorse(), ensure that the caller is the owner of the horse before allowing them to feed it. By adding a require statement to check ownership, you prevent unauthorized feeding of horses that don't belong to the caller.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Nonexistent horses can be fed
Rewards breakdown
nSLOC
460This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.