First Flight #10: One Shot

Summary

Random Number Generator logic can be manipulated

Vulnerability Details

msg.sender, block.timestamp and block.prevrandao can be manipulated by any user to generate a number that is always bigger than the defenderRapperSkill. Thus, winning the battle every time.

Attack Scenario :

1. User mint rapper NFT and stake it to mint credTokens.

2. User keeps creating new addresses until the random number is greater than defenderRapperSkill.

3. User then transfers both NFT and credTokens to that address.

4. That address enters the goOnStageOrBattle function to win the battle and claim credTokens.

Impact

Attacker can always win the rap battles which defeats the purpose of the RapBattle contract.

Tools Used

Manual Review

Recommendations

Use oracle such as Chainlink to generate Random Number