First Flight #10: One Shot

Summary

Missing NFT ownership verification for challengers

Vulnerability Details

The RapBattle.sol::goOnStageOrBattle() function lacks a verification mechanism to ensure that the msg.sender, acting as a challenger, owns the NFT token being submitted for battle. This oversight allows any user to engage an NFT token owned by another player in battle, risking the owner's funds without their consent.

Impact

NFT owners lose exclusive control over deciding when their tokens go to battle.

Tools Used

Manual review.

Recommendations

Implement a verification step in RapBattle.sol::goOnStageOrBattle() to check that the msg.sender is the rightful owner of the NFT token, identified by the _tokenId passed to the function.