First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

`HorseStore.sol::isHappyHorse` and `HorseStore.huff::isHappyHorse` do not check whether the correspondig horse exists, potentially providing an irrelevant answer.

glitchr

Description

According to the documentation, the isHappyHorse function should allow anyone to see if a horse is happy. However, the function returns an answer (boolean) even if the horseId NFT does not exist (not minted yet).

Impact

Non existing horse NFT can be unhappy, which seems to break the idea of an NFT.

Since the isHappyHorse transacation does not revert in this case, the user will not be informed that the horse NFT he fed does not exist.

Proof of concept

isHappyHorse does not revert if the horseId does not correspond to an existing horse.

function testNotExistingHorseCantBeHappyNorUnhappy() public {
uint256 timestampFed = 10000000;
vm.warp(timestampFed);
vm.roll(timestampFed);
​
uint256 horseId = horseStore.totalSupply();
​
vm.expectRevert();
horseStore.isHappyHorse(horseId);
}

Recommended mitigation

In both HorseStore.sol and HorseStore.huff, isHappyHorse should revert if there is no owner registered for the horseId parameter.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.