Submission Details
Severity:
Missing checks for _credBet greater than 0
Summary
Missing checks that _credBet greater than 0.
Vulnerability Details
Checks that _credBet greater than 0 is missing.
Which means rappers can go on stage for a battle without betting any CRED.
POC
Put the test excerpts below in `test/OneShotTest.t.sol`
// Test that a user can stake and compete at the same time
function testUserStakeAndCompete() public twoSkilledRappers {
vm.startPrank(user);
oneShot.mintRapper();
oneShot.approve(address(streets), 2);
streets.stake(2);
oneShot.approve(address(rapBattle), 0);
cred.approve(address(rapBattle), 3);
rapBattle.goOnStageOrBattle(0, 3);
vm.stopPrank();
vm.startPrank(challenger);
oneShot.approve(address(rapBattle), 1);
cred.approve(address(rapBattle), 3);
rapBattle.goOnStageOrBattle(1, 3);
vm.stopPrank();
}
// Test that a user can go on stage
function testGoOnStage() public mintRapper {
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
rapBattle.goOnStageOrBattle(0, 0);
address defender = rapBattle.defender();
assert(defender == address(user));
}
In the terminal, run the following commands:
forge test --mt testUserStakeAndCompeteforge test --mt testGoOnStage
Impact
Rappers can take part into battles without taking any risk. The winners' battlesWon property of OneShot::rapperStats will increase.
That is unfair to those winners who bet credibility (CRED) in battle, as their winning worth the same as those no-risk winners.
Tools Used
Manual review
Recommendations
At the beginning of `RapBattle::goOnStageOrBattle()`, check if `_credBet` is different from 0.
function goOnStageOrBattle(uint256 _tokenId, uint256 _credBet) external {
+ require(_credBet != 0, "RapBattle: Bet amounts can not be 0")
if (defender == address(0)) {
defender = msg.sender;
defenderBet = _credBet;
defenderTokenId = _tokenId;
emit OnStage(msg.sender, _tokenId, _credBet);
oneShotNft.transferFrom(msg.sender, address(this), _tokenId);
credToken.transferFrom(msg.sender, address(this), _credBet);
} else {
// credToken.transferFrom(msg.sender, address(this), _credBet);
_battle(_tokenId, _credBet);
}
}
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.