Submission Details
Impact:
Likelihood:
Test Suite Bug/Vulnerability: Missing Test Coverage for Critical Vulnerabilities
High: Missing Test Coverage for Critical Vulnerabilities
Description
-
The test suite lacks coverage for several critical vulnerabilities present in the contracts.
-
No tests exist for high-severity issues like the
withdrawAllFailedCreditstheft vulnerability, NFT burn authorization bypass, or reentrancy attacks.
Risk
Likelihood:
-
Critical bugs go undetected without test coverage
-
Vulnerabilities reach production unnoticed
Impact:
-
False confidence in contract security
-
Critical vulnerabilities remain undetected
-
Potential for significant financial losses
Recommended Mitigation
Add comprehensive test coverage for all identified vulnerabilities:
// Test for H-1: Anyone can steal failed credits
function test_StealFailedCredits() public {
// Setup victim with failed credits
// Attacker calls withdrawAllFailedCredits(victim)
// Verify attacker receives funds
}
// Test for NFT H-1: Anyone can burn any NFT
function test_AnyoneCanBurnAnyNFT() public {
// Mint NFT to owner
// Different user burns it without permission
// Verify NFT is destroyed
}
// Test for H-2: Reentrancy in buy-now
function test_ReentrancyInBuyNow() public {
// Deploy malicious bidder contract
// Trigger reentrancy during refund
// Verify attack is prevented or succeeds
}
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.