First Flight #7: Horse Store

Summary

In Huff, only 1 horse token can be minted due to horseId not updating.

Vulnerability Details

The Huff code is not correctly updating the TOTAL_SUPPLY and horseId after a horse token is minted, leading to the ALREADY_MINTED error when trying to mint the second horse. When minting, the horseId param may have been intended to be derived from the TOTAL_SUPPLY. Since TOTAL_SUPPLY does not update horseId, the mint function reverts because the Huff code checks for horseId- uniquiness.

Impact

This completely breaks the functionality of the protocol. Multiple users should be able to mint horse tokens.

Proof of Concept: please place this code at the bottom of Base_Test.t.sol and run

forge test --mt testTwoUsersCanMintAHorse -vvvvv. please also add consol2 to the imports like so: import {Test, console2, StdInvariant} from "forge-std/Test.sol";

Recommendations

TOTAL_SUPPLY not updating can be fixed by adding the following code:

This code should be added after the transfer event has been emitted. in the _MINT function.

While this does fix TOTAL_SUPPLY not updating, it still not simultaneously updates horseId

After extensive research I regrettably was not able to write a functional model where the updated TOTAL_SUPPLY transfers it's value to horseId.

therefore:
I'm looking forward to a deepdive for this codebase in part 2 of the sc security audit course!