First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Function `RapBattle.goOnStageOrBattle` allows users to battle with themselves.

Ritos

Summary

Function RapBattle.goOnStageOrBattle allows users to battle with themselves which leads to the impossibility of losing and griefing other users.

Vulnerability Details

Function goOnStageOrBattle in contract RapBattle if defender != address(0) do not check that defenderTokenId not equal _tokenId.

1 Attacker call RapBattle.goOnStageOrBattle and became a defender

2 User call RapBattle.goOnStageOrBattle with intent to be a challenger

3 Attacker monitoring the mempool for user's call and frontrun it with the same rapper

4 Attacker becomes challenger and win battle no matter as defender or challenger

5 User transaction is succeeds but he has become a defender and his Credibility tokens and OneShot NFT is stuck on RapBattle contract until someone calls RapBattle.goOnStageOrBattle.

Impact

Lack of check that defenderTokenId not equal challenger _tokenId leads to the possibility of a battle with themselves and griefing other users without putting at risk attacker Credibility token.

Tools Used

Manual review.

Recommendations

Make the following changes in RapBattle.sol

https://github.com/Cyfrin/2024-02-one-shot/blob/47f820dfe0ffde32f5c713bbe112ab6566435bf7/src/RapBattle.sol#L38C1-L52C6

function goOnStageOrBattle(uint256 _tokenId, uint256 _credBet) external {
if (defender == address(0)) {
defender = msg.sender;
defenderBet = _credBet;
defenderTokenId = _tokenId;
​
​
emit OnStage(msg.sender, _tokenId, _credBet);
​
​
oneShotNft.transferFrom(msg.sender, address(this), _tokenId);
credToken.transferFrom(msg.sender, address(this), _credBet);
} else {
// credToken.transferFrom(msg.sender, address(this), _credBet);
+ require(defenderTokenId != _tokenId);
_battle(_tokenId, _credBet);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

It's YOU vs YOU

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.