Summary

Malicious defenders can force challengers to waste gas for 0 rewards.

Vulnerability Details

RapBattle:goOnStageOrBattle() allows a _credBet of 0, enabling defenders to force challengers into pointless battles.

PoC

• A malicious user becomes a defender with a a _credBet value of 0.

• A legitimate user wishes to battle, however they notice that they will receive no reward by winning the battle.

• If the user wants to be able to battle for rewards in the future, they must defeat the defender anyway, otherwise no other legitimate user will be able to become the defender.

Impact

Malicious users can force challengers to waste gas battling for 0 potential rewards. The defender needs to be removed before a legitimate user can replace them.

Tools Used

Manual Review.

Recommendations

Prevent zero _credBet in RapBattle:goOnStageOrBattle() with require(_credBet>0);.