[Bug-Candidate]: Sender with zero balance can call the fuzzing harness with msg.value being non-zero
- Dominant language
- Haskell
- Stars
- 3.2k
- Forks
- 432
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 5
Description
### Describe the issue:
Sender with zero balance can call the fuzzing harness with msg.value being non-zero
### Code example to reproduce the issue:
Repro: https://github.com/rappie/echidna-sender-bug-repro
### Version:
master
### Relevant log output:
```shell
checkSenderBalance(): failed!💥
Call sequence:
SenderBalance.checkSenderBalance() Value: 0xd766e4f69b27688c
Traces:
emit Log(senderBalanceAtDeploy=0, senderBalanceNow=0, sender=0x0000000000000000000000000000000000010000, msgValue=15521344913595132044)
```
Contributor guide
Research direction
Start by running the reproduction at https://github.com/rappie/echidna-sender-bug-repro and inspect the checkSenderBalance() failure and trace. Follow how the fuzzing harness generates the shown msg.value for the zero-balance sender. Done means the reproduced invariant passes without allowing a non-zero value from an unfunded sender.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell, solidity
- Domain
- security, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100