Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

SetTreatCost and addTreat functions do not validate new cost

0xjunwei

Summary

SetTreatCost and addTreat functions do not validate argument input _cost

Vulnerability Details

function addTreat(string memory _name, uint256 _rate, string memory _metadataURI) public onlyOwner {
treatList[_name] = Treat(_name, _rate, _metadataURI);
treatNames.push(_name);
emit TreatAdded(_name, _rate, _metadataURI);
}
​
function setTreatCost(string memory _treatName, uint256 _cost) public onlyOwner {
require(treatList[_treatName].cost > 0, "Treat must cost something.");
treatList[_treatName].cost = _cost;
}

Treat must cost something, but new cost is not validated thus i could set _cost to 0, which would result in TrickATreat to revert.

And the function checks on set cost, so calling the function again to set a cost from 0, would revert.

Additionally addTreat do not perform checks on cost, and i could input 0 as a _rate within the function.

Impact

Treat would be broken if cost is set to 0 initially or modified to 0, users could not call TrickOrTreat function, Owner could not modify cost after cost been set to 0.

Tools Used

Manual Review

Recommendations

Add more input validations on argument parameters in both AddTreat and SetTreatCost function.

function addTreat(string memory _name, uint256 _rate, string memory _metadataURI) public onlyOwner {
// Additional line
require(_rate > 0, "Rate must be greater than zero.");
treatList[_name] = Treat(_name, _rate, _metadataURI);
treatNames.push(_name);
emit TreatAdded(_name, _rate, _metadataURI);
}
​
function setTreatCost(string memory _treatName, uint256 _cost) public onlyOwner {
// Additional line
require(_cost > 0, "Cost must be greater than zero.");
require(treatList[_treatName].cost > 0, "Treat must already exist.");
treatList[_treatName].cost = _cost;
}
​
​
​
​
Updates

Appeal created

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[invalid] Zero treat cost

The cost of the treat is set only by the owner (in the constructor, in addTreat and in setTreatCost). That means the cost of the treat will always be greater than zero.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.