Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Access Control on Adding Treats

0xserpent

Summary

The addTreat() function does not check if a treat with the same name already exists, potentially leading to unintended overwriting of treat data.

Vulnerability Details

Function: addTreat()

  • Code Reference:

treatList[_name] = Treat(_name, _rate, _metadataURI);

There is no validation to check if a treat with the same name is already present, which could lead to overwriting data.

Impact

Overwriting treats can cause operational issues and confusion for users if existing treats are accidentally replaced.

Tools Used

Manual Code Review

Recommendations

Add a check to prevent duplicate treat names:

require(treatList[_name].cost == 0, "Treat with this name already exists");

This ensures that no treat can be overwritten accidentally.

Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] Duplicate treats

The function `addTreat` is called by the owner. The owner is trusted. There will be no duplicates.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.