First Flight #13: Baba Marta

Summary

MartenitsaToken::createMartenitsa function has a require statement require(bytes(design).length > 0, "Design cannot be empty"); but it can be by passing by using whitespaces i.e " "
which is 0x20 in hex and technically not empty but visually empty string i.e a string of spaces.

Impact

Any malicious user can create two strings with design strings as

1. " " (single whitespace) - low price

2. " " (double whitespaces) - high price

The strings appear to be same but they aren't (in hex one is "0x20" and other is "0x2020").

Any user who wants to buy this "empty" design martenitsa can be baited to buy the high price one by the malicious user as it is visually of similar design to the low price one

Proof of Concept

Note: Please Import {console} in MartenitsaToken.t.sol by adding import {console} from "forge-std/Test.sol"; at the top for the PoC's to work effortlessly

The User can create a martenitsa with single or multiple whitespaces

Recommendations

Whitespaces check should be added to MartenitsaToken::createMartenitsa function to prevent design being visually empty string.In the MartenitsaToken::createMartenitsa function after the second require statement add the following piece of code: