Challenger can predict the outcome of battle and not lose their tokens
Summary
Challanger will never loose their tokens because of they don't need to send tokens before battle
Vulnerability Details
Challanger can view if defender is already stored in the RapBattle::defender and after it they write test case using current state of the blockchain to call goOnStageOrBattle function without approving tokens to the RapBattle contract if it fails it will mean that challanger will loose in case sending transaction; if it not fails they will send real transaction to get prizes
Impact
Challenger will always win or transaction will be failed if they should loose
Tools Used
Manual testing with Remix
Recommendations
Uncomment line 49 to send tokens to the contract and after getting the battle results change transferring call to send the whole totalPrize to the winner
Lead Judging Commences
missing check for sufficient `_credBet_` approval
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.