Submission Details
Severity:
## H - 1: User able to enter battle as both challenger and defender
Description :
Due to no check on who is entering the battle, a user is able to play as both : defender and challenger.
Impact :
Someone can exploit this to constantly have their nfts battling which lets others unable to battle.
Proof of Concept :
Add the following test and it will pass:
function testSamedefenderandchallenger() public mintRapper {
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
// rapper entering as defender
rapBattle.goOnStageOrBattle(0, 0);
oneShot.mintRapper();
oneShot.approve(address(rapBattle), 1);
// rapper entering as challenger
rapBattle.goOnStageOrBattle(1, 0);
vm.stopPrank();
}
Recommended Mitigation
Add the following check in rapBattle.goOnStageOrBattle :
else {
+ require(defender != msg.sender, "RapBattle: You cannot battle yourself");
_battle(_tokenId, _credBet);
}
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.