Submission Details
Severity:
Non existent horses can be fed.
Summary
feedHorse don't check whether provided horseId exists or not.
Vulnerability Details
Any random horseId can be fed.
function testFeedingNonExistentHorse() public {
uint256 horseId = horseStore.totalSupply();
vm.prank(user);
horseStore.feedHorse(horseId+5); // random horse number
assertEq(horseStore.horseIdToFedTimeStamp(horseId+5), block.timestamp);
}
Impact
Medium
Tools Used
foundry
Recommendations
require(horseId <= totalSupply());
Updates
Lead Judging Commences
inallhonesty
over 1 year ago
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Nonexistent horses can be fed
Rewards breakdown
nSLOC
460This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.