First Flight #14: AirDropper

Summary

Function in testPwned() MerkleAirdropTest.t.sol attempts to execute malicious code on people who run the test

Vulnerability Details

function testPwned() public {
    string[] memory cmds = new string[](2);
    cmds[0] = "touch";
    cmds[1] = string.concat("youve-been-pwned");
    cheatCodes.ffi(cmds);
}
Seems to be malicious code 

Impact

Allows the attacker to run malicious code

Tools Used

Manual Review

Recommendations

Remove this test function