VegaSec self-audit reference

Source (2036 chars)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/// @title VegaTokenVulnerable
/// @notice Fictional internal VegaSec self-audit fixture only. Not deployed, not sold, no financial promise.
/// @dev This intentionally unsafe contract exists so VegaSec can prove vulnerable-vs-fixed audit deltas.
contract VegaTokenVulnerable {
    string public constant FIXTURE_SCOPE = "VegaSec fictional internal self-audit fixture";

    mapping(address => uint256) public balances;
    address public owner;
    address public reviewer = 0x1111111111111111111111111111111111111111;
    uint256 public reviewRound;

    constructor() payable {
        owner = msg.sender;
        balances[msg.sender] = 1_000_000;
    }

    receive() external payable {}

    function mintForReview(address account, uint256 amount) external {
        // Intentional issue: tx.origin authorization can be phished through another contract.
        require(tx.origin == owner, "origin owner only");
        balances[account] += amount;
    }

    function unsafeReviewerLottery(address[] calldata reviewers) external returns (address picked) {
        require(reviewers.length > 0, "reviewers required");
        // Intentional issue: block.timestamp is miner/validator-influenced and unsafe as randomness.
        picked = reviewers[block.timestamp % reviewers.length];
        reviewer = picked;
        reviewRound += 1;
    }

    function withdrawReviewCredit(uint256 amount) external {
        require(balances[msg.sender] >= amount, "insufficient credits");
        // Intentional issue: external low-level call before effects enables reentrancy-style drains.
        (bool ok,) = payable(msg.sender).call{value: amount}("");
        require(ok, "transfer failed");
        balances[msg.sender] -= amount;
    }

    function retireFixture() external {
        // Intentional issue: tx.origin gate plus selfdestruct is unsafe and should never ship.
        require(tx.origin == owner, "origin owner only");
        selfdestruct(payable(owner));
    }
}

Source (2125 chars)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/// @title VegaTokenFixed
/// @notice Fictional internal VegaSec self-audit fixture only. Not deployed, not sold, no financial promise.
/// @dev Shows remediation evidence for the paired vulnerable fixture.
contract VegaTokenFixed {
    string public constant FIXTURE_SCOPE = "VegaSec fictional internal self-audit fixture";

    mapping(address => uint256) public balances;
    address public owner;
    bool private locked;

    event ReviewCreditsMinted(address indexed account, uint256 amount);
    event ReviewCreditWithdrawn(address indexed account, uint256 amount);

    modifier onlyOwner() {
        require(msg.sender == owner, "owner only");
        _;
    }

    modifier nonReentrant() {
        require(!locked, "reentrant call");
        locked = true;
        _;
        locked = false;
    }

    constructor() payable {
        owner = msg.sender;
        balances[msg.sender] = 1_000_000;
    }

    receive() external payable {}

    function mintForReview(address account, uint256 amount) external onlyOwner {
        require(account != address(0), "account required");
        // Remediation: use msg.sender with explicit owner control instead of origin-based authorization.
        balances[account] += amount;
        emit ReviewCreditsMinted(account, amount);
    }

    function selectReviewer(address[] calldata reviewers, uint256 index) external onlyOwner returns (address picked) {
        require(reviewers.length > 0, "reviewers required");
        require(index < reviewers.length, "index out of range");
        // Remediation: deterministic operator-selected review routing; no timestamp-derived randomness.
        picked = reviewers[index];
    }

    function withdrawReviewCredit(uint256 amount) external nonReentrant {
        require(balances[msg.sender] >= amount, "insufficient credits");
        // Remediation: checks-effects-interactions before a bounded native transfer.
        balances[msg.sender] -= amount;
        payable(msg.sender).transfer(amount);
        emit ReviewCreditWithdrawn(msg.sender, amount);
    }
}