First Flight #10: One Shot

Summary

The Protocol is sending its winners the Cred tokens and Rappernft. However, if the winner is a smart contract wallet does not have either the receive or fallback functions to receive the cred tokens or onERC721Received to receive the nft. The protocol will be unabled to push and have locked funds and nfts.

Vulnerability Details

1. 2 smart contract wallets enter the RapBattle without the one of receive or accepting the nft

2. winner is selected, and the winner cannot receive his nfts or his cred token

Impact

Winner will not receive his assets.

Recommendations

Create a mapping of addresses -> payout so winners can pull their funds out themselves, putting the owness on the winner to claim their prize.