First Flight #7: Horse Store

Summary

The HorseStore.huff::MAIN() macro is missing a revert statement after the function selector, leaving the protocol vulnerable to
unintended function calls. If an nonexistent function is invoked, it could lead to the execution of the wrong function.

Vulnerability Details

When the protocol is called with a nonexistent function, it defaults to calling GET_TOTAL_SUPPLY(). Due to the absence of a revert
statement after the selector checks and not finding a matching function, it falls through to GET_TOTAL_SUPPLY().
To rectify this, a revert should be added after the checks.
Additionally, there is a reference to MINT_HORSE() at the end of the functions, which should be removed.

Impact

Calling the protocol with an existing function may lead to an unintended function being executed, potentially causing issues.
While the current scenario with GET_TOTAL_SUPPLY() is harmless, if a critical function were in its place, it could pose a significant
security risk to the protocol.

A test scenario demonstrates calling the protocol with a non-existing function, such as thisFunctionNotExists,
resulting in the execution of the GET_TOTAL_SUPPLY() function and retrieving the total supply as a result.

Output

Tools Used

Manual review

Recommendations

Please consider adding a revert statement after the selectors check to enhance security. Additionally, remove the reference to
MINT_HORSE() at the end.