Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

`setTreatCost()` will always revert if a Treat was added with 0 cost

0xlasadie

Summary

In addTreat(), a new Treat can be added without any checks and in the event where a treat was added with 0 cost (_rate), the cost cannot be updated anymore in setTreatCost().

Vulnerability Details

setTreatCost() will revert when the cost of the treat is 0 and there is no way to update the cost.

function setTreatCost(string memory _treatName, uint256 _cost) public onlyOwner {
-> require(treatList[_treatName].cost > 0, "Treat must cost something.");
treatList[_treatName].cost = _cost;
}

Impact

function testCannotSetTreatCostIfZeroCost() public {
spookySwap.addTreat("Zero Cost", 0, "ipfs://zero-cost-metadata");
​
vm.expectRevert("Treat must cost something.");
spookySwap.setTreatCost("Zero Cost", 1 ether);
}

Results

[PASS] testCannotSetTreatCostIfZeroCost() (gas: 91840)
Traces:
[91840] TrickOrTreatTest::testCannotSetTreatCostIfZeroCost()
├─ [81652] SpookySwap::addTreat("Zero Cost", 0, "ipfs://zero-cost-metadata")
│ ├─ emit TreatAdded(name: "Zero Cost", cost: 0, metadataURI: "ipfs://zero-cost-metadata")
│ └─ ← [Stop]
├─ [0] VM::expectRevert(Treat must cost something.)
│ └─ ← [Return]
├─ [1393] SpookySwap::setTreatCost("Zero Cost", 1000000000000000000 [1e18])
│ └─ ← [Revert] revert: Treat must cost something.
└─ ← [Stop]

Tools Used

Foundry

Recommendations

Instead of ensuring the cost of the current Treat is bigger than 0, ensure that the new _cost should be bigger than 0.

function setTreatCost(string memory _treatName, uint256 _cost) public onlyOwner {
- require(treatList[_treatName].cost > 0, "Treat must cost something.");
+ require(_cost > 0, "Treat must cost something.");
treatList[_treatName].cost = _cost;
}
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] Zero treat cost

The cost of the treat is set only by the owner (in the constructor, in addTreat and in setTreatCost). That means the cost of the treat will always be greater than zero.

0xlasadie Submitter
8 months ago
bube Lead Judge
8 months ago
bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] Zero treat cost

The cost of the treat is set only by the owner (in the constructor, in addTreat and in setTreatCost). That means the cost of the treat will always be greater than zero.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.