First Flight #14: AirDropper

Summary

Deployment script will fail because privateKey is not passed in vm.startBroadcast

Vulnerability Details

The vm.startBroadcast accepts private key as a parameter, It use the gas and fetch the deployer address from the provided private key. If we look at the foundry docs then we can see how it is used.

https://book.getfoundry.sh/tutorials/solidity-scripting#:~:text=uint256%20deployerPrivateKey%20%3D%20vm.envUint(%22PRIVATE_KEY%22)%3B%0A%20%20%20%20%20%20%20%20vm.startBroadcast(deployerPrivateKey)%3B

Impact

deploy script will fail without private key

Tools Used

manual review

Recommendations

Use private key from env in deployment.