Submission Details
Impact:
Likelihood:
SPDX License Typo Makes Contract Unlicensed
Author Revealed upon completion
Missing 'e' in SPDX-Lincense-Identifier voids MIT license, creating legal ambiguity
Description
SPDX-Lincense-Identifier: MIT → missing 'e'. No valid SPDX license detected. Contract = unlicensed/proprietary.
@> // SPDX-Lincense-Identifier: MIT // BROKEN
Risk
Likelihood: High (Every deploy)
Impact: Low (Legal/tooling issue, no fund risk)
Proof of Concept
Run the following in bash:
forge inspect RaiseBoxFaucet SPDX-License-Identifier
logs:
error: invalid value 'SPDX-License-Identifier' for '<FIELD>'
[possible values: abi, bytecode, deployedBytecode, assembly, legacyAssembly, assemblyOptimized, methodIdentifiers, gasEstimates, storageLayout, devdoc, ir, irOptimized, metadata, userdoc, ewasm, errors, events, standardJso
Recommended Mitigation
Just make this change in both the contract and the script!!
- // SPDX-Lincense-Identifier: MIT
+ // SPDX-License-Identifier: MIT
Rewards breakdown
nSLOC
157This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.