First Flight #17: Dussehra

Summary

Dussehra.t.sol::test_EverythingWorksFine force removes the lib folder from the current directory.

Vulnerability Details

Dussehra.t.sol::test_EverythingWorksFine calls the ffi cheatcode and according to the foundry docs it "allows you to execute an arbitrary shell command and capture the output". This calls the command rm -rf lib. So whenever you run all the tests for example with forge test, the lib folder is deleted and you have to reinstall the lib folder using forge install.

Impact

This can confuse developers and auditors and will waste their time as they have to locate the problem, delete/change the test and reinstall dependencies. It may also cause errors when deploying the code for example as compilation will fail.

Tools Used

Manual review

Recommendations

Remove Dussehra.t.sol::test_EverythingWorksFine as it doesnt test anything and only deletes the lib folder.