Submission Details
Severity:
Malicious code in the test suite that could compromize the developer computer
Summary
The test suite features a malicious function that can access the computer files
Vulnerability Details
This malicious function is accessing the file system of the computer running the tests.
function testPwned() public {
string[] memory cmds = new string[](2);
cmds[0] = "touch";
cmds[1] = string.concat("youve-been-pwned");
cheatCodes.ffi(cmds);
}
Impact
This function can compromise the computer and potentially look for private keys and other valuable informations.
Tools Used
Manual review
Recommendations
Remove this function before running tests
- import { _CheatCodes } from "./mocks/CheatCodes.t.sol";
- function testPwned() public {
- string[] memory cmds = new string[](2);
- cmds[0] = "touch";
- cmds[1] = string.concat("youve-been-pwned");
- cheatCodes.ffi(cmds);
- }
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Reason: Out of scope
Assigned finding tags:
ffi
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.