AirDropper
AI First Flight #5
Beginner FriendlyDeFiFoundry
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

FFI flag is true, and there exist a malicious test suite that can execute arbitatry commands on host machine, which can result in severe result

hmpippo

[H-1] FFI flag is true, and there exist a malicious test suite that can execute arbitatry commands on host machine, which can result in severe result

Description

  • FFI flag is true, and there exist a malicious test suite that can execute arbitatry commands on host machine.

function testPwned() public {
string[] memory cmds = new string[](2);
cmds[0] = "touch";
cmds[1] = string.concat("youve-been-pwned");
cheatCodes.ffi(cmds);
}

Risk

Likelihood: High

  • Anyone run this test suite could expose his computer to danger!

Impact: High

  • The test suite could do arbitrary malicious commands on host machine, eg: steal your privacy information or private key.

Proof of Concept

​

Recommended Mitigation

Turn the FFI flag to false in foundry.toml.

- ffi = true
+ ffi = false
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 10 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!