Treats Name is Not Unique Which Can Lead To Duplicates
Summary
in function addTreat the inputs are not checked if they have been added before. this can lead to two different NFT having the same name.
https://github.com/Cyfrin/2024-10-trick-or-treat/blob/9cb3955058cad9dd28a24eb5162a96d759bfa842/src/TrickOrTreat.sol#L37
Vulnerability Details
The parameter passed to push the treat is the name. this means that if there was a name used more than once , the newly added treat will overwrite the first one in storage.
Impact
Multiple NFT can have the same name.
NFT'S that have been thought to have been added are overwritten
Tools Used
manual search
Recommendations
add a require statement to prevent duplicate checks
Appeal created
[invalid] Duplicate treats
The function `addTreat` is called by the owner. The owner is trusted. There will be no duplicates.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.