crytic / crytic/echidna

[Bug-Candidate]: Sender with zero balance can call the fuzzing harness with msg.value being non-zero

Open
#1,556 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Haskell
Stars
3.2k
Forks
432
Avg merge
1d 20h
Merged PRs (30d)
5

Description

### Describe the issue:

Sender with zero balance can call the fuzzing harness with msg.value being non-zero

### Code example to reproduce the issue:

Repro: https://github.com/rappie/echidna-sender-bug-repro

### Version:

master

### Relevant log output:

```shell
checkSenderBalance(): failed!💥
Call sequence:
SenderBalance.checkSenderBalance() Value: 0xd766e4f69b27688c

Traces:
emit Log(senderBalanceAtDeploy=0, senderBalanceNow=0, sender=0x0000000000000000000000000000000000010000, msgValue=15521344913595132044)
```

Contributor guide

Open the contributing guide

Research direction

Start by running the reproduction at https://github.com/rappie/echidna-sender-bug-repro and inspect the checkSenderBalance() failure and trace. Follow how the fuzzing harness generates the shown msg.value for the zero-balance sender. Done means the reproduced invariant passes without allowing a non-zero value from an unfunded sender.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell, solidity
Domain
security, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.