Submission Details
Severity:
L-1: No duplicate checks for tokenId in goOnStageOrBattle function
Summary
The _battle function allows the same NFT tokenId to be used as both the defender and the challenger, potentially leading to unfair advantages and system logic disruption.
Vulnerability Details
Missing Validation: There's no check to prevent identical tokenId values from being used in a single battle by the defender and challenger.
Impact
Potential for DoS: An attacker can disrupt the availability of the battle system for others.
Tools Used
Manual review
Recommendations
+ require(defenderTokenId != _tokenId, "Cannot use the same NFT as defender and challenger");
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.