Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing checks in `addTreat`

jumpupjoran

Summary

The SpookySwap contract lacks validation check for weather or not the filled in data is empty nor if the Treat already exists. If the owner mistakenly would enter a Treat double or with no name, Cost or no metaURi, than this cannot be changed anymore.

vulnerability details

no checks in the addTreat function

function addTreat(string memory _name, uint256 _rate, string memory _metadataURI) public onlyOwner {
treatList[_name] = Treat(_name, _rate, _metadataURI);
treatNames.push(_name);
emit TreatAdded(_name, _rate, _metadataURI);
}

Impact

If the metaUri would be empty than this could cause some problems because people would mint an NFT without an image. If Name would be empty then this would not have a great impact just that when people would call the getTreats function it would give some empty names. If the cost would be empty then this also does not cause any danger because they cannot mint the NFT thanks to following line of code in trickOrTreat

require(treat.cost > 0, "Treat cost not set.");

Tools used

ChatGpt

recommendations

implement some checks weather or not there has been filled in empty information, and weather or not the Treat already existed.

function addTreat(string memory _name, uint256 _rate, string memory _metadataURI) public onlyOwner {
+ require(_rate != 0, "Rate must be higher than 0");
+ require(keccak256(abi.encodePacked(_name)) != keccak256(abi.encodePacked("")), "Name must not be empty");
+ require(
+ keccak256(abi.encodePacked(_metadataURI)) != keccak256(abi.encodePacked("")),
+ "Metadata URI must not be empty"
+ );
+ // check if treat already exists
+ for (uint256 i = 0; i < treatNames.length; i++) {
+ require(
+ keccak256(abi.encodePacked(treatNames[i])) != keccak256(abi.encodePacked(_name)),
+ "Treat with this name already exists"
+ );
+ }
treatList[_name] = Treat(_name, _rate, _metadataURI);
treatNames.push(_name);
emit TreatAdded(_name, _rate, _metadataURI);
}
Updates

Appeal created

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] Duplicate treats

The function `addTreat` is called by the owner. The owner is trusted. There will be no duplicates.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.