GivingThanks

First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: medium
Invalid

Bug Report: Incorrect Import Path in GivingThanks.sol or foundry.toml incorrect remmaping

Summary:
In the GivingThanks.sol file, there is an incorrect import path for the @openzeppelin contract from OpenZeppelin. The import path in the contract should align with the one used in the foundry.toml configuration, which remaps the OpenZeppelin contracts directory. This discrepancy could lead to import errors or compilation issues.

Vulnerability Details:
The current import statement in GivingThanks.sol:

import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
import "@openzeppelin/contracts/utils/Strings.sol";
import "@openzeppelin/contracts/utils/Base64.sol";

does not align with the remapping configuration in foundry.toml:

remappings = [
"openzeppelin-contracts/=lib/openzeppelin-contracts/",
"forge-std/=lib/forge-std/src/"
]

As per the remappings, OpenZeppelin contracts should be imported as:

import "@openzeppelin-contracts/contracts/access/Ownable.sol";
import "@penzeppelin-contracts/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
import "@penzeppelin-contracts/contracts/utils/Strings.sol";
import "@penzeppelin-contracts/contracts/utils/Base64.sol";

This mismatch between the remapping configuration in foundry.toml and the import statement in the contract can cause issues during compilation. Specifically, Foundry may not be able to locate the correct file without the proper remapping.

Impact:
[M] Medium Severity

  • Compilation failure: The incorrect import path could lead to an error during the compilation of the contract if the remapping is not properly resolved.

  • Inconsistency: This creates an inconsistency between the remapping configuration and the actual import path used in the code. It could confuse developers and lead to unexpected behaviors in different environments.

  • Gas costs and execution failures: If the remapping is ignored and the contract doesn't find the right library, this could cause the contract to fail execution or result in a mismatch of expected behavior.

Tools Used:

  • Manual code review

Recommendations:

  1. Correct the import path: Update the import statements in GivingThanks.sol to match the remapped paths defined in foundry.toml.

    Correct the import in GivingThanks.sol from:

import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
import "@openzeppelin/contracts/utils/Strings.sol";
import "@openzeppelin/contracts/utils/Base64.sol";

to:

import "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/utils/Strings.sol";
import "@openzeppelin/contracts/utils/Base64.sol";

Verify all import paths: Ensure that all imports in the contract are consistent with the remapping configurations in the foundry.toml file.

foundry.toml:

remappings = [
"@openzeppelin/contracts=lib/openzeppelin-contracts/contracts",
"forge-std/=lib/forge-std/src/"
]
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.