First Flight #10: One Shot

Summary

A malicious attacker can be able to deploy a reentrancy attack and drain the funds in the contract by exploiting the weak randomness in the RapBattle.sol::_battle function.

Vulnerability Details

The Weak Randomness that occurs by hashing msg.sender, block.timestamp, block.pervrando

can further be exploited and drain contract funds. In the RapBattle.sol::_battle function if the random number is predicted by a malicious user and they become the winner, the challenger's bet and the money deposited by the defender will be transferred to them else the money from the contract is sent to them. Malicious attackers can reenter this function as a winner to drain any funds that the contract has even if there are no challengers.

Impact

Any funds held by the contract whether deposited by the defender or any other challenger can be drained ad all funds meant for the rightful winners will be lost.

Tools Used

Manual Review

Recommendations:

1. The root cause of this attack is weak randomness generated from the hashing of block.timestamp, block.prevrandao, msg.sender. The usual recommendation is to always use oracles like chainlink VRF to generate random numbers off-chain.

2. Consider adding the nonReentrant modifier from openzeppelin ReentrancyGuard library in the function: