Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-02] Contract Deployment Failure Due to ETH Constraints (Note: This file is not in scope)

bhorprakash

Summary

Note: This file is not in scope

If the setUp() function does not send the required ETH when invoking the
MysteryBox constructor, the require statement checking msg.value >= SEEDVALUE will fail. This failure leads to a transaction revert,
preventing the MysteryBox contract from being deployed successfully.

Vulnerability Details

In the TestMysteryBox::setUp() function, if no ETH is sent during the
deployment of the MysteryBox contract, the deployment will fail. This
occurs because the MysteryBox contract has a payable constructor that
requires a minimum amount of ETH to be sent. Specifically, the
constructor checks if the amount of ETH sent (denoted by msg.value) is
greater than or equal to a constant value SEEDVALUE. If this condition is
not met, the constructor will revert, preventing the MysteryBox contract
from being created successfully.

File: TestMysteryBox.t.sol
function setUp() public {
owner = makeAddr("owner");
user1 = address(0x1);
user2 = address(0x2);
​
vm.prank(owner);
mysteryBox = new MysteryBox(); //@audit No `ETH` is sent during the
deployment
console.log("Reward Pool Length:", mysteryBox.getRewardPool().length);
}
File: MysteryBox.sol
constructor() payable {
owner = msg.sender;
boxPrice = 0.1 ether;
require(msg.value >= SEEDVALUE, "Incorrect ETH sent"); //@audit Check
for ETH sent
// Initialize with some default rewards
rewardPool.push(Reward("Gold Coin", 0.5 ether));
rewardPool.push(Reward("Silver Coin", 0.25 ether));
rewardPool.push(Reward("Bronze Coin", 0.1 ether));
rewardPool.push(Reward("Coal", 0 ether));
}

Testing Outcome

Upon running the Forge command in VS Code:

forge test

The following error was encountered:

[FAIL. Reason: setup failed: revert: Incorrect ETH sent] setUp() (gas: 0)

Impact

Deploying the MysteryBox contract without sending the required ETH will
cause the require statement to trigger a transaction revert. Consequently:

The MysteryBox contract will not be deployed to the blockchain.
Any gas fees incurred during the failed transaction will be consumed, but
the contract will not exist.

Tools Used

Manual Code Review and Foundry Testing Framework

Recommendations

To resolve this issue, ensure that the setUp() function includes a
mechanism to send the required ETH when deploying the MysteryBox
contract. This can be achieved by modifying the contract deployment line to
include the appropriate amount of ETH, for example:

mysteryBox = new MysteryBox{value: 0.1 ether}(); // Sending the required ETH

Implementing this recommendation will allow the contract to be deployed
successfully.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.