Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Denial of Service via Array Panic in addTreat Function

iepathos

Summary

The addTreat function is vulnerable to an arithmetic overflow when the treats array grows beyond type(uint16).max. This causes a panic condition that makes the contract completely unusable, as core functionality like adding new treats and retrieving the treat list will fail.

Vulnerability Details

Location: src/TrickOrTreat.sol:addTreat()

Proof of Concept:

function testArrayPanicFailure() public {
// Start with owner
vm.startPrank(owner);
// Try to add treats until we hit the array panic
// We'll use a smaller number to demonstrate the issue
uint256 i;
bool panicked = false;
try this.addManyTreats() {
// If we get here, no panic occurred
} catch Panic(uint256 code) {
panicked = true;
console.log("Panic occurred at length:", i);
console.log("Panic code:", code);
}
vm.stopPrank();
// Get final array length
string[] memory finalTreats = spookySwap.getTreats();
console.log("Final array length:", finalTreats.length);
// Assert that we caught the panic
assertTrue(panicked, "Should have caught an arithmetic panic");
}
​
// Helper function to actually perform the additions
function addManyTreats() external {
for(uint256 i = 0; i < type(uint16).max + 1; i++) {
string memory treatName = string(
abi.encodePacked("Treat", toString(i))
);
if (i % 1000 == 0) {
console.log("Current array length:", i);
}
spookySwap.addTreat(treatName, 1 ether, "uri");
}
}

Impact

The contract becomes completely unusable once array length exceeds uint16 max. All core functionality fails due to panic condition. There is no way to recover once the panic condition is reached. This could permanently lock funds in the contract.

Tools Used

Forge

Recommendations

  1. Add a maximum limit to the number of treats that can be added

  2. Consider pagination for getTreats()

  3. Add explicit bounds checking before adding new treats:

require(treats.length < type(uint16).max, "Too many treats");
Updates

Appeal created

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.