First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Rappers can Battle Themselves to Avoid Encounters with Stronger Opponents

EloiManuel

Summary

It is possible to call RapBattle::goOnStageOrBattle() consecutively using the same rapper NFT to perform a battle and avoid potential battle losses.

Vulnerability Details

Neither the external function goOnStageOrBattle() nor the internal function _battle() ensures a rapper NFT cannot battle against itself.

Impact

An attacker could front-run an undesired opponent by calling RapBattle::goOnStageOrBattle() again when the current defender is one of their rapper NFTs and battle with themselves.

Proof of Concept

In order to observe the behavior explained above, add the following test to test/OneShotTest.t.sol:

function testBattleMyself() public mintRapper {
// In order to use 1 cred, lets stake my rapper for 1 day
vm.startPrank(user);
oneShot.approve(address(streets), 0);
streets.stake(0);
vm.warp(1 days + 1);
streets.unstake(0);
cred.approve(address(rapBattle), 1);
oneShot.approve(address(rapBattle), 0);
rapBattle.goOnStageOrBattle(0, 1);
rapBattle.goOnStageOrBattle(0, 1);
vm.stopPrank();
}

And run it with forge test -vvvv --mt testBattleMyself. Observe that it is possible to battle using the same NFT as defender and challenger.

Tools Used

Manual analysis and Foundry.

Recommendations

Consider adding a check to the _battle() function to make sure tokenIDs cannot battle against themselves.

function _battle(uint256 _tokenId, uint256 _credBet) internal {
address _defender = defender;
require(defenderBet == _credBet, "RapBattle: Bet amounts do not match");
+ require(defenderTokenId != _tokenId, "RapBattle: Rapper NFT IDs should not match");
uint256 defenderRapperSkill = getRapperSkill(defenderTokenId);
uint256 challengerRapperSkill = getRapperSkill(_tokenId);
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

It's YOU vs YOU

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

It's YOU vs YOU

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.