Beginner FriendlyFoundryNFT
100 EXP
View results
Submission Details
Severity: low
Valid

Missing proper functionality to update `battlesWon` field leads to loss of record of wins for every rapper

Summary

There is a field inside the IOneShot::RapperStats struct called battlesWon which should likely store the number of battles won by a particular rapper. However, there is no function in the OneShot contract that lets the RapBattle contract update this variable inside the rapperStats mapping.

Vulnerability Details

The OneShot::updateRapperStats function let's only the Streets contract update the rapperStats mapping. However, the RapBattle contract, where every battle happens, must also be provided a way to access the rapperStats mapping so that it can increment the battlesWon field by 1 at the end of every battle for the winner NFT.

Impact

There is no way to record number of wins of a rapper.

Tools Used

Foundry

Recommendations

Create a function inside OneShot contract to increment the battlesWon field stored inside the rapperStats mapping. Also, in order to provide a proper access control to this function, there might be a need for another state variable to hold the RapBattle contract's address along with a setter for this variable.

RapBattle private _rapBattle;
function setRapBattle(RapBattle rapBattle) external onlyOwner {
_rapBattle = rapBattle;
}
function updateBattlesWon(uint256 tokenId) external {
require(msg.sender == address(_rapBattle), "Not the RapBattle contract");
rapperStats[tokenId].battlesWon++;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`battlesWon` is never updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.