First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

If the horse was fed exactly 24 hours ago, the horse will be unhappy

bube

Summary

The documentation of the HorseStore protocol said that the horse is happy if it was fed within the past 24 hours, but the function HorseStore::isHappyHorse excludes the time exactly 24 hours ago.

Vulnerability Details

In the documentation of the project is said:

If horse X has been fed within the past 24 hours, horse X must be happy.

This means that if the horse was fed exactly 24 hours ago, the horse should be happy.
But the implementation of the function HorseStore::isHappyHorse excludes the time exactly 24 hours ago and returns false:

function isHappyHorse(uint256 horseId) external view returns (bool) {
@> if (horseIdToFedTimeStamp[horseId] <= block.timestamp - HORSE_HAPPY_IF_FED_WITHIN) {
return false;
}
return true;
}
​

Impact

The owner of the horse think that his horse is happy, because he had fed it 24 hours ago, but the function HorseStore::isHappyHorse returns false.
The following test shows the issue. You can add this test to the file Base_Test.t.sol and you can execute it with the Foundry command: forge test --match-test "testFeedingExactly24HoursAgoMakesHappyHorse" -vvv

​
function testFeedingExactly24HoursAgoMakesHappyHorse() public {
uint256 horseId = horseStore.totalSupply();
vm.warp(0);
vm.roll(0);
console2.log(block.timestamp);
vm.prank(user);
horseStore.mintHorse();
horseStore.feedHorse(horseId);
​
vm.warp(86400);
vm.roll( 86400);
console2.log(block.timestamp);
// it returns false
assertEq(horseStore.isHappyHorse(horseId), true);
}
​

The test is failed because it assumes that the horse should be happy if it was fed exactly 24 hours ago.

Tools Used

Manual Review, Foundry

Recommendations

Change the condition about the time when the horse is fed in HorseStore::isHappyHorse:

​
function isHappyHorse(uint256 horseId) external view returns (bool) {
+ if (horseIdToFedTimeStamp[horseId] < block.timestamp - HORSE_HAPPY_IF_FED_WITHIN) {
- if (horseIdToFedTimeStamp[horseId] <= block.timestamp - HORSE_HAPPY_IF_FED_WITHIN) {
return false;
}
return true;
}
​

After this change the horse will be happy if it was fed exactly 24 hours ago.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.