Unlimited attack attempts from a challenger with insuficient cred token balance.
Summary
The challenger can participate in a battle without having any funds, with no risk at all.
Vulnerability Details
The only place where the function will revert is after trying to send the cred tokens from the challenger account to the defender, only if the challenger has already lost the battle. With no checks prior to that, the defender it's in an unfair position, because the challenger can attack without risking anything if he has unsufficient token balance.
Impact
Unfair advantage for the challenger.
Tools Used
Manual Review
Recommendations
Have the challenger to send his bet(cred tokens) to the RapBattle.sol contract prior to executing the battle logic and choosing the winner.
Lead Judging Commences
missing check for sufficient `_credBet_` approval
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.