First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

isHappyHorse() in Huff calculates the time wrongly and gives wrong results

kaiziron

Summary

isHappyHorse() in Huff calculates the time wrongly and gives wrong results

Vulnerability Details

IS_HAPPY_HORSE() macro in the Huff implementation checks the time difference between the current time and the time the horse was fed, if HORSE_HAPPY_IF_FED_WITHIN is less than the time difference which means the time difference is more than or equal to HORSE_HAPPY_IF_FED_WITHIN it will jump to start_return_true and pushes 0x01 to the stack, then stores it in the memory and returns it

This is wrong, because it is returning true if the time since the horse was fed is more than or equal to HORSE_HAPPY_IF_FED_WITHIN. But if a horse have not been fed within the past 24 hours, it should return false instead

Impact

isHappyHorse() in Huff gives wrong results

PoC

function testHorseHappyAtDifferentTime() public {
uint256 horseId = horseStore.totalSupply();
vm.prank(user);
vm.warp(1705288246);
horseStore.mintHorse();
horseStore.feedHorse(horseId);
assertEq(horseStore.isHappyHorse(horseId), true);
​
vm.warp(block.timestamp + 1);
assertEq(horseStore.isHappyHorse(horseId), true);
vm.warp(block.timestamp + 1 days);
assertEq(horseStore.isHappyHorse(horseId), false);
}
Running 1 test for test/HorseStoreSolidity.t.sol:HorseStoreSolidity
[PASS] testHorseHappyAtDifferentTime() (gas: 118076)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.91ms
​
Running 1 test for test/HorseStoreHuff.t.sol:HorseStoreHuff
[FAIL. Reason: assertion failed] testHorseHappyAtDifferentTime() (gas: 111472)
Test result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 789.36ms

Tools Used

Manual review

Recommendations

Check the time correctly by changing lt to gt in HorseStore.huff#L100

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong comparison in IS_HAPPY_HORSE()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.