First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Inconsistent behavior between Huff and Solidity version that can lead to lock of token

0xlouistsai

Summary

The solidity version of horse store does not implement receive and fallback function, the contract should be unable to receive native ether token, but the. huff version does not follow the pattern, either does the huff version implement withdraw function, leading to lock of ether.

Vulnerability Details

Add the following testing:

function testReceive() public {
deal(user, 1 ether);
vm.prank(user);
(bool success, ) = address(horseStore).call{value: 1 ether}("X");
assertTrue(success);
}

The huff version success indicating that the ether is transferred to the user, however, the solidity version contract reverts since both fallback and receive is not implemented.

Impact

The huff version of horseStore is able to receive ether but does not implement the withdraw function, it will lead to lock of ether.

Tools Used

Foundry

Recommendations

Implement withdraw function in the contract or restrict the ether transfer to the contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

HUFF functions are payable when they shouldn't be

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.