Submission Details
Severity:
Reentrancy in `OneShot::mintRapper` causes exploitation of the contract.
Summary
Detection of the reentrancy bug (https://github.com/crytic/not-so-smart-contracts/tree/master/reentrancy).
Vulnerability Details
External calls:
- _safeMint(msg.sender,tokenId) (src/OneShot.sol#31)
- retval = IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,data) (lib/openzeppelin-contracts/contracts/token/ERC721/ERC721.sol#467-480)
State variables written after the call(s):
- rapperStats[tokenId] = RapperStats({weakKnees:true,heavyArms:true,spaghettiSweater:true,calmAndReady:false,battlesWon:0}) (src/OneShot.sol#34-35)
Impact
The reentrancy is benign because it's exploitation would have the same effect as two consecutive calls. However, it is a potential vector for future attacks.
Tools Used
Slither
Recommendations
Apply reentrancy guard to OneShot::mintRapper function using CEI pattern
Updates
Lead Judging Commences
inallhonesty
over 1 year ago
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
mintRapper reentrancy leads to fighting having better chances of winning.
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.