First Flight #7: Horse Store
First Flight #7
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Feeding horses at certain block timestamps will fail, violating the invariant that horses must be able to be fed at all times

stefanlatinovic

Summary

Feeding a horse at specific block timestamps is prevented by the implementation of the HorseStore.huff::FEED_HORSE() function, leading to Denial-of-Service (DoS).

Vulnerability Details

The HorseStore.huff::FEED_HORSE() function contains a code segment that reverts the transaction if the remainder of the current block timestamp and number 17 (0x11) is equal to 0, which is expressed as:

0x11 timestamp mod
endFeed jumpi
revert
endFeed:
stop

Impact

Horses are not able to be fed at all times.

Proof of Concept (PoC)

Add the next test in HorseStoreHuff.t.sol.

function test_FeedingHorseRevertsAtSpecificTimestamps(uint256 horseId, uint256 feedAt) public {
vm.assume(feedAt % 0x11 == 0); // simulate the timestamp of the block at which a transaction will fail
vm.warp(feedAt);
​
vm.expectRevert();
horseStore.feedHorse(horseId);
}

Run a test with forge test --mt test_FeedingHorseRevertsAtSpecificTimestamps.

Tools Used

  • Foundry

Recommendations

It is recommended to remove the code that reverts at certain block timestamps.

Recommended changes to HorseStore.huff::FEED_HORSE() function:

#define macro FEED_HORSE() = takes (0) returns (0) {
timestamp // [timestamp]
0x04 calldataload // [horseId, timestamp]
STORE_ELEMENT(0x00) // []
​
// End execution
- 0x11 timestamp mod
- endFeed jumpi
- revert
- endFeed:
stop
}

Add the next test in HorseStoreHuff.t.sol.

function test_FeedingHorseIsPossibleAtAnyTimestamp(uint256 horseId, uint256 feedAt) public {
vm.warp(feedAt);
​
horseStore.feedHorse(horseId);
}

Run a test with forge test --mt test_FeedingHorseIsPossibleAtAnyTimestamp.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

FEED_HORSE() macro does not allow users to feed a horse if the timestamp is divisible by 17

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.