First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The number of battles won by users is not updated

josh4324

Summary

When rappers win battles in the contract, their stat profiles reflecting these wins are not updated. This leads to inaccurate public stat information that misrepresents actual rapper performance.

Vulnerability Details

The goOnStageOrBattle(uint256 _tokenId, uint256 _credBet) function handles conducting battles and determining winners. However, it does not call the updateRapperStats() function after victories to update:

battlesWon

So values from getRapperStats() do not align with reality.

Proof of code

function testBattleWinsNotRecorded(uint256 randomBlock) public twoSkilledRappers {
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
cred.approve(address(rapBattle), 3);
console.log("User allowance before battle:", cred.allowance(user, address(rapBattle)));
rapBattle.goOnStageOrBattle(0, 3);
vm.stopPrank();
​
vm.startPrank(challenger);
oneShot.approve(address(rapBattle), 1);
cred.approve(address(rapBattle), 3);
console.log("User allowance before battle:", cred.allowance(challenger, address(rapBattle)));
​
// Change the block number so we get different RNG
vm.roll(randomBlock);
vm.recordLogs();
rapBattle.goOnStageOrBattle(1, 3);
vm.stopPrank();
​
Vm.Log[] memory entries = vm.getRecordedLogs();
// Convert the event bytes32 objects -> address
address winner = address(uint160(uint256(entries[0].topics[2])));
assert(cred.balanceOf(winner) == 7);
​
IOneShot.RapperStats memory rap = oneShot.getRapperStats(0);
assert(rap.battlesWon == 0);
​
IOneShot.RapperStats memory rap1 = oneShot.getRapperStats(1);
assert(rap1.battlesWon == 0);
}
​

Impact

The impacts of this stat discrepancy are:

Reputation and achievements don't match actual wins

Inaccurate metadata can wrongly influence battles

Undermines credibility of the rapper histories

Tools Used

Manual Review

Recommendations

To address this, goOnStageOrBattle(uint256 _tokenId, uint256 _credBet) should call updateRapperStats() for the winner to increment battlesWon and recalculate any other stat impacts from the lyrics.

Accurately maintaining these profiles preserves the integrity of rapper histories and reputations, keeping the game fair.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`battlesWon` is never updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.