First Flight #10: One Shot

Summary

_battle() internal function uses transferFrom() function to transfer the NFT of defender to himself.

Vulnerability Details

Defender can be a contract instead of an EOA.

Impact

In that case, user may not receive the NFT back.

Tools Used

manual review

Recommendations

It's recommended either to use safetransferFrom or to check if the user is an EOA at the beginning of the function.

require(tx.origin == msg.sender, "not EOA");