Beatland Festival

Description

The project configuration enables Foundry Foreign Function Interface (ffi = true) globally, and includes test code that executes shell commands via vm.ffi().

In test/FestivalPass.t.sol, the test test_PartialUserFlow() defines a multi-step bash script interacting directly with the developer's /dev/tty terminal and executes it using vm.ffi(inputs).

Risk

Likelihood:

• Always occurs whenever any developer, auditor, or automated CI/CD pipeline runs forge test.

Impact:

• Host compromise / supply chain risk: Arbitrary shell command execution on local machines and CI environments running tests.

Proof of Concept

Run forge test --match-test test_PartialUserFlow:
Foundry executes the subshell process and terminal interaction directly on the host machine.

Recommended Mitigation

1. Remove ffi = true from foundry.toml unless strictly necessary and sandboxed.

2. Remove any arbitrary shell invocations (vm.ffi) from tests.