First Flight #10: One Shot

Summary

In RapBattle :: _battle() function there is one defender and challenger.The winning or losing of a battle is depends on the randomness generated by the function.If the defender skills is less then random value the challenger is won.

Vulnerability Details

In RapBattle :: _battle() function there is no check exist which check that defender is not equal to challenger.
So that if both challenger and defender is user self that in both cases either defender or challenger is won.The winning status of user is improved without any fear of losing the battle and lossing its tokens.

Impact

POC

    modifier chSkilledRappers() {
    vm.startPrank(user);
    oneShot.mintRapper();
    oneShot.approve(address(streets), 0);
    streets.stake(0);
    vm.stopPrank();

    vm.startPrank(user);
    oneShot.mintRapper();
    oneShot.approve(address(streets), 1);
    streets.stake(1);
    vm.stopPrank();

    vm.warp(4 days + 1);

    vm.startPrank(user);
    streets.unstake(0);
    vm.stopPrank();

    vm.startPrank(user);
    streets.unstake(1);
    vm.stopPrank();
    _;
}

function testsameusercanbeboth(uint256 randomBlock) public chSkilledRappers {
        vm.startPrank(user);
        oneShot.approve(address(rapBattle), 0);
        cred.approve(address(rapBattle), 3);
        console.log("User allowance before battle:", cred.allowance(user, address(rapBattle)));
        console.log("Balance of defender before battle",cred.balanceOf(user));
       
        rapBattle.goOnStageOrBattle(0, 3);
        console.log("Balance of defender after battle",cred.balanceOf(user));
       
        vm.stopPrank();

        vm.startPrank(user);
        oneShot.approve(address(rapBattle), 1);
        cred.approve(address(rapBattle), 3);
        console.log("User allowance before battle:", cred.allowance(user, address(rapBattle)));
        console.log("Balance of challenger before battle",cred.balanceOf(user));
        // Change the block number so we get different RNG
        vm.roll(randomBlock);
        vm.recordLogs();
        rapBattle.goOnStageOrBattle(1, 3);
        console.log("Balance of challenger after battle",cred.balanceOf(user));
      
        vm.stopPrank();

        Vm.Log[] memory entries = vm.getRecordedLogs();
        address winner = address(uint160(uint256(entries[0].topics[2])));
        console.log("winner is" , winner);
        }

Tools Used

Foundry

Recommendations

Its recommended to add a check that the address of defender and challenger is not same at the same battle.

require(address(defender) != address(msg.sender) , "you are already on stage");