Submission Details
Severity:
High winning chances due to wrong base skill value
Summary
A base skill of 65 is applied to all rappers but according to the documentation it's supposed to be 50.
Vulnerability Details
In the RapBattle contract we have:
uint256 public constant BASE_SKILL = 65; // The starting base skill of a rapper
RappBattle::BASE_SKILL is used to evaluate a rapper's finalSkill according to RapBattle::getRapperSkill()
function getRapperSkill(uint256 _tokenId) public view returns (uint256 finalSkill) {
IOneShot.RapperStats memory stats = oneShotNft.getRapperStats(_tokenId);
finalSkill = BASE_SKILL;
if (stats.weakKnees) {
finalSkill -= VICE_DECREMENT;
}
if (stats.heavyArms) {
finalSkill -= VICE_DECREMENT;
}
if (stats.spaghettiSweater) {
finalSkill -= VICE_DECREMENT;
}
if (stats.calmAndReady) {
finalSkill += VIRTUE_INCREMENT;
}
}
And the bigger the defender's skills, the bigger his chance to win:
// If random <= defenderRapperSkill -> defenderRapperSkill wins, otherwise they lose
if (random <= defenderRapperSkill) {
// We give them the money the defender deposited, and the challenger's bet
credToken.transfer(_defender, defenderBet);
credToken.transferFrom(msg.sender, _defender, _credBet);
} else {
// Otherwise, since the challenger never sent us the money, we just give the money in the contract
credToken.transfer(msg.sender, _credBet);
}
Impact
Loss of fund as defenders will have bigger chances to win
Tools Used
Manual review
Recommendations
Fix the value of RapBattle::BASE_SKILL
uint256 public constant BASE_SKILL = 50; // The starting base skill of a rapper
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
Battle skill is 65 not 50
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.