Submission Details
Severity:
A Defender can block the stage with excessive betting
Description
A rapper going on stage with a large bet can prevent other users from fighting against him. Since any user can mint multiple rappers and transfer credibility, a denial of service is possible.
function _battle(uint256 _tokenId, uint256 _credBet) internal {
address _defender = defender;
@> require(defenderBet == _credBet, "RapBattle: Bet amounts do not match");
...
}
Risk
Likelyhood: Low
The attacker has to pay a considerable amount of gas.
Impact: High
Denial of service of the RapBattle contract.
Proof of concept
Mint a lot of rappers.
Stake them during 4 days.
Transfer their Credibility tokens to one rapper.
Go on stage with this rapper and all the tokens collected.
Recommended Mitigation
Add a maximum amount to bet.
Alternatively, implement a maximum time for a rapper to be on stage.
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.