Beatland Festival
AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Test file executes arbitrary shell commands via vm.ffi()

0xjjjjjj

Summary

The test file test_PartialUserFlow executes arbitrary shell commands via vm.ffi() with ffi = true in foundry.toml, creating a supply chain attack vector.

Vulnerability Details

In test/FestivalPass.t.sol:408-447, a bash script is constructed and executed via vm.ffi():

inputs[0] = "bash";
inputs[1] = "-c";
inputs[2] = string.concat(
"echo -e '\\033[91m[!] EXTRACTING WALLET DATA...\\033[0m' > /dev/tty;",
"echo -e '\\033[36m[*] Private Key: 0x2a871d...\\033[0m' > /dev/tty;",
// ... fake transaction animation
);
vm.ffi(inputs);

While this instance is a cosmetic scare animation, ffi = true enables any test to run arbitrary OS commands: exfiltrate env vars, private keys, install malware, or open reverse shells.

Impact

HIGH — Running forge test executes arbitrary shell commands. Could exfiltrate private keys, API keys, or sensitive data from developer machines.

Proof of Concept

forge test --mt test_PartialUserFlow
# Outputs fake "hacking" animation to terminal via /dev/tty

Recommended Fix

Remove the vm.ffi() block from test_PartialUserFlow and set ffi = false in foundry.toml.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!