First Flight #16: Mafia Takedown

Summary

The contracts do not pre-check passed in values from users before trying to perform actions with them.

Vulnerability Details

The contracts are depending on the runtime to save them from unexpected actions, like underflows and overflows. This is bad practice and could lead to unpredictable behaviour.

Impact

Low. The security services have burned many cpu cycles trying to see if an underflow or overflow would lead to anything other than a panic, but sadly it was not to be.

Tools Used

Recommendations

Just check the caller of the function has what they say they want before accepting that as truth and performing further actions.