First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

`RapBattle.goOnStageOrBattle` allows 0 bet.

Ritos

Summary

Function goOnStageOrBattle in contract RapBattle allows zero bets for users.

Vulnerability Details

Function goOnStageOrBattle in contract RapBattle do not check _credBet parameter that, along with the frontrun, leads to possibility for griefing attack.

POC

RapBattle.defender == address(0), no one in a battle right now.

1 User call goOnStageOrBattle with some _credBet greater than zero.

2 Attacker monitoring the mempool for user's goOnStageOrBattle.

3 Attacker frontrun this transaction with their call goOnStageOrBattle with parameter _credBet equal 0.

4 User call will be reverted due to bet checking in RapBattle._battle :

function _battle(uint256 _tokenId, uint256 _credBet) internal {
address _defender = defender;
>>> require(defenderBet == _credBet, "RapBattle: Bet amounts do not match");

Impact

Attacker do not need to spend Credibility tokens to griefing other users.

Tools Used

Manual review.

Recommendations

Make the following changes in RapBattle.sol

https://github.com/Cyfrin/2024-02-one-shot/blob/47f820dfe0ffde32f5c713bbe112ab6566435bf7/src/RapBattle.sol#L38C1-L52C6

function goOnStageOrBattle(uint256 _tokenId, uint256 _credBet) external {
+ require(_credBet > 0, "The bet amount must be greater than 0");
​
if (defender == address(0)) {
defender = msg.sender;
defenderBet = _credBet;
defenderTokenId = _tokenId;
​
​
emit OnStage(msg.sender, _tokenId, _credBet);
​
​
oneShotNft.transferFrom(msg.sender, address(this), _tokenId);
credToken.transferFrom(msg.sender, address(this), _credBet);
} else {
// credToken.transferFrom(msg.sender, address(this), _credBet);
_battle(_tokenId, _credBet);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.