First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[SOLIDITY] no input validation of `horseId`

0x18a6

Summary

HorseStore.sol has a vulnerability where a non-existent horse can be fed and considered happy, even though it doesn't exist. Furthermore, when a horse with the non-existing ID is actually minted, it's considered happy even though it hasn't been fed.

Vulnerability Details

The vulnerability lies in the feedHorse() and isHappyHorse() functions. feedHorse() doesn't check for input validity (e.g. if the horse exists before feeding it). As a result, it's possible to feed a non-existent horse. isHappyHorse() also doesn't check if the horse exists before checking its happiness. This means a non-existent horse can be considered happy.

Impact

Given the invariant:

If horse X has been fed within the past 24 hours, horse X must be happy <=> If horse X has NOT been fed within the past 24 hours, horse X must NOT be happy!

There is at least one scenario where the invariant can be broken:

PoC

address attacker = makeAddr("0x18a6");
​
function test_feedUnexistingHorse() external {
vm.warp(1 days); // `isHappyHorse()` substraction underflows otherwise
​
vm.startPrank(attacker);
horseStore.feedHorse(4); // unexisting horse #4 is fed
assertEq(horseStore.horseIdToFedTimeStamp(4), 1 days);
assertTrue(horseStore.isHappyHorse(4)); // unexisting horse #4 is happy because it was fed within the last 1 days
for (uint256 i; i < 4; i++) {
horseStore.mintHorse();
} // existing horse #4 is not fed
assertTrue(horseStore.isHappyHorse(4)); // existing horse #4 is happy although it was NOT fed within the last 1 days!!!
}

Tools Used

Manual review

Recommendations

Validate feedHorse() and isHappyHorse() inputs:

function feedHorse(uint256 horseId) external {
require(horseId < totalSupply(), "unvalid input");
horseIdToFedTimeStamp[horseId] = block.timestamp;
}
​
function isHappyHorse(uint256 horseId) external view returns (bool) {
require(horseId < totalSupply(), "unvalid input");
// rest of the code...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Nonexistent horses can be fed

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.