First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`RapBattle::_battle()` emits incorrect data on `Battle` event

davide

Summary

The RapBattle::_battle() function potentially emits the Battle event with an incorrect winner due to a discrepancy in the winner determination logic.

Vulnerability Details

The RapBattle::battle() function's documentation and logic aim to determine the battle winner based on the comparison between a randomly generated number (random) and the defender's skill level (defenderRapperSkill). The comment within the function specifies the intended logic:

// If random <= defenderRapperSkill -> defenderRapperSkill wins, otherwise they lose

This logic is correctly implemented in the conditional check:

if (random <= defenderRapperSkill) {

However, the event that announces the battle's outcome incorrectly calculates the winner using a strict less-than comparison (random < defenderRapperSkill), as shown below:

emit Battle(msg.sender, _tokenId, random < defenderRapperSkill ? _defender : msg.sender);

Impact

Consider a scenario where both random and defenderRapperSkill equal 65. According to the intended logic, the defender should emerge victorious. However, due to the erroneous comparison in the event emission, the system mistakenly declares the challenger as the winner. This discrepancy can lead to external systems misinterpreting the outcome of battles, affecting game dynamics and participant strategies.

Tools Used

Manual review.

Recommendations

To resolve this inconsistency, adjust the event emission logic to align with the documented and implemented winner determination criteria:

- emit Battle(msg.sender, _tokenId, random < defenderRapperSkill ? _defender : msg.sender);
+ emit Battle(msg.sender, _tokenId, random <= defenderRapperSkill ? _defender : msg.sender);
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Contradictory battle result event

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.