First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The challenger can try to win rap battle with defender without risking loosing cred tokens.

k3ysk1lls

Summary

The challenger can try to win rap battle with defender without risking loosing cred tokens.

Vulnerability Details

When challenger enters the battle their cred tokens are not transferred to the RapBattle contract. Line 49 of the contract was commented out. Hence the challenger can enter the battle without any risk of loosing the cred tokens.

Impact

The impact of this error is as follows. The challenger can take part in the battle without transferring the token to the Battle, hence:
a) if they win - they just win
b) if they loose - the contract reverts (trying to transfer the cred token from the challenger) and the defender waits for next battle with the challenger

Tools Used

Insert the following test into your test file to see the findings.

​
function testFakeItTillYouMakeIt() public twoSkilledRappers {
​
//the case when the winner is challenger
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
cred.approve(address(rapBattle), 1);
rapBattle.goOnStageOrBattle(0, 1);
vm.stopPrank();
// challenger does not approve the cred token to the rapBattle
vm.startPrank(challenger);
oneShot.mintRapper();
oneShot.approve(address(rapBattle), 1);
rapBattle.goOnStageOrBattle(1, 1);
//now the winner is defender
vm.warp(block.timestamp + 1);
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
cred.approve(address(rapBattle), 1);
rapBattle.goOnStageOrBattle(0, 1);
vm.stopPrank();
vm.startPrank(challenger);
oneShot.mintRapper();
oneShot.approve(address(rapBattle), 1);
vm.expectRevert();
rapBattle.goOnStageOrBattle(1, 1);
//the user remains in rapBattle waiting for another challenger move
assert(rapBattle.defender() == user);
}
​

Recommendations

Treat the user and challenger in the same way making them approve the cred tokens to the battle before starting the challenge - use code of line 49 (first link above)

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

missing check for sufficient `_credBet_` approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.