First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[HUFF] comparison of time difference is inverted

0x18a6

Summary

IS_HAPPY_HORSE() has a vulnerability where the comparison of the time difference is inverted.

Vulnerability Details

The vulnerability lies in the IS_HAPPY_HORSE() macro. This macro uses the lt opcode to compare the time since the horse was last fed (timestamp - horseFedTimestamp) with a constant (HORSE_HAPPY_IF_FED_WITHIN_CONST). However, the order of the operands is inverted, meaning it checks if HORSE_HAPPY_IF_FED_WITHIN_CONST is less than timestamp - horseFedTimestamp.

Impact

HORSE_HAPPY_IF_FED_WITHIN_CONST < timestamp - horseFedTimestamp can be manipulated to break the first invariant:

PoC

function test_IsHorseHappy() external {
vm.warp(1 days); // `isHappyHorse` underflows otherwise
horseStore.feedHorse(5);
vm.warp(1000 days); // horse #5 is fed 1000 days ago, must not be happy!
assertTrue(horseStore.isHappyHorse(5)); // turns out horse #5 is happy!!!
}

Tools Used

Foundry test.

Recommendations

Swap the operands of lt.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong comparison in IS_HAPPY_HORSE()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.