Submission Details
Severity:
Challengers Can Battle Without Owning RapperNFTs or Cred Tokens
Summary
Once a Rapper has gone on stage a challenger does not need any Rapper NFTs or Cred Tokens to be able to battle them
Vulnerability Details
There are no checks as to whether a challenger owns the Rapper or Cred tokens it takes to enter a battle.
Impact
Anyone can battle a rapper on stage at no cost.
Tools Used
Manual Review
Foundry
PoC - add this to OneShotTest.t.sol
function test_canBattleWithRapperAndCredIDontOwn() public twoSkilledRappers {
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
cred.approve(address(rapBattle), 4);
rapBattle.goOnStageOrBattle(0, 4);
vm.stopPrank();
address biggie = makeAddr("Biggie");
vm.startPrank(biggie);
assert(cred.balanceOf(biggie) == 0);
rapBattle.goOnStageOrBattle(1, 4);
}
Recommendations
Add checks that the user trying to challenge the Rapper onstage has a Rapper NFT and the proper Cred tokens to do battle.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Challenger can use any nft to battle - not necessarily theirs
missing check for sufficient `_credBet_` approval
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.