Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect validation in function SpookySwap::setTreatCost

al88nsk

Summary

Function SpookySwap::setTreatCost does not allow to update treat that has cost set to 0.

Vulnerability Details

Function SpookySwap::setTreatCost checks the current treat cost value for 0, but it should check the new value instead. This leads to not being able to update the treat cost if the current treat cost is 0.

Impact

If a treat was added with zero cost, the owner is unable to update the cost to any other value.

Tools Used

Manual review

Recommendations

Change the validation so that it checks the new cost value:

-require(treatList[_treatName].cost > 0, "Treat must cost something.");
+require(_cost > 0, "Treat must cost something.");
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] Zero treat cost

The cost of the treat is set only by the owner (in the constructor, in addTreat and in setTreatCost). That means the cost of the treat will always be greater than zero.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.