The repository contains a test that invokes:

​

(https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/test/FestivalPass.t.sol#L447) with a dynamically constructed shell command.

Foundry's FFI cheatcode executes host-system commands outside the EVM sandbox.

​

The repository includes a test that constructs a shell command and executes it using:

​

(https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/test/FestivalPass.t.sol#L447)

​

Although the current implementation only prints terminal output, the same mechanism can execute arbitrary commands with the privileges of the user running the tests.

​

Any developer, auditor, CI worker, or judge running:

​

forge test --ffi

​

implicitly grants code execution permissions to the repository.

​

An attacker could:

​

Read local SSH keys

Read cloud credentials

Exfiltrate environment variables

Install malware

Modify local files

Compromise CI/CD runners

​

Resulting in complete compromise of the host environment.

When tests are executed with: forge test --ffi arbitrary operating-system commands are executed on the host machine. A malicious contributor could modify the command payload to exfiltrate secrets, install malware, or compromise developer environments.

The test suite executes:

​

https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/test/FestivalPass.t.sol#L447

​

where:

​

(https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/test/FestivalPass.t.sol#L422)

https://github.com/CodeHawks-Contests/2025-07-beatland-festival/blob/5034ccf16e4c0be96de2b91d19c69963ec7e3ee3/test/FestivalPass.t.sol#L423

allowing unrestricted shell execution.

​

Remove unnecessary FFI usage.

If FFI is required:

Isolate FFI tests

Disable them by default

Restrict executed commands

Document security implications

vm.ffi(inputs); - remove this code

console.log(...) + add this code