Submission Details
Severity:
Users can make battles using the same NFT as `defender` and `challenger`
Summary
A user can make a battle using the same _tokenId as defender and challenger
Vulnerability Details
there is no check that tokenID of the defender is not equal to the tokenID of the challenger
Impact
Unintended behavior of the smart contract
POC
function test_battle() public {
vm.startPrank(user1);
oneShot.mintRapper();
oneShot.approve(address(streets), 0);
streets.stake(0);
vm.stopPrank();
vm.startPrank(user2);
oneShot.mintRapper();
oneShot.approve(address(streets), 1);
streets.stake(1);
vm.stopPrank();
vm.startPrank(user3);
oneShot.mintRapper();
oneShot.approve(address(streets), 2);
streets.stake(2);
vm.stopPrank();
vm.warp(start+4 days);
vm.startPrank(user1);
streets.unstake(0);
vm.stopPrank();
vm.startPrank(user2);
streets.unstake(1);
vm.stopPrank();
vm.startPrank(user3);
streets.unstake(2);
vm.stopPrank();
uint256 balance2 = cred.balanceOf(user2);
uint256 balance3 = cred.balanceOf(user3);
vm.startPrank(user2);
cred.approve(address(rapBattle), 4);
oneShot.approve(address(rapBattle), 1);
rapBattle.goOnStageOrBattle(1,4);
cred.approve(address(rapBattle), 4);
rapBattle.goOnStageOrBattle(1,4);
vm.stopPrank();
uint256 balance_final2 = cred.balanceOf(user2);
assert(balance2 == balance_final2);
}
}
├─ [65404] RapBattle::goOnStageOrBattle(1, 4)
│ ├─ [1183] OneShot::getRapperStats(1) [staticcall]
├─ [65404] RapBattle::goOnStageOrBattle(1, 4)
│ ├─ [1183] OneShot::getRapperStats(1) [staticcall]
│ │ └─ ← (false, false, false, true, 0)
│ ├─ [1183] OneShot::getRapperStats(1) [staticcall]
│ │ └─ ← (false, false, false, true, 0)
│ ├─ emit Battle(challenger: 0x0000000000000000000000000000000000000002, tokenId: 1, winner: 0x0000000000000000000000000000000000000002)
│ ├─ [18516] Credibility::transfer(0x0000000000000000000000000000000000000002, 4)
│ │ ├─ emit Transfer(from: RapBattle: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], to: 0x0000000000000000000000000000000000000002, amount: 4)
│ │ └─ ← true
│ ├─ [19215] Credibility::transferFrom(0x0000000000000000000000000000000000000002, 0x0000000000000000000000000000000000000002, 4)
│ │ ├─ emit Transfer(from: 0x0000000000000000000000000000000000000002, to: 0x0000000000000000000000000000000000000002, amount: 4)
│ │ └─ ← 0x0000000000000000000000000000000000000000000000000000000000000001
│ ├─ [19524] OneShot::transferFrom(RapBattle: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], 0x0000000000000000000000000000000000000002, 1)
│ │ ├─ emit Transfer(from: RapBattle: [0x5991A2dF15A8F6A256D3Ec51E99254Cd3fb576A9], to: 0x0000000000000000000000000000000000000002, id: 1) │ │ └─ ← ()
│ └─ ← ()
├─ [0] VM::stopPrank()
│ └─ ← ()
├─ [629] Credibility::balanceOf(0x0000000000000000000000000000000000000002) [staticcall]
│ └─ ← 4
└─ ← ()
Tools Used
Foundry
Recommendations
To add a check that _tokenId of the defender is not equal to the _tokenId of the challenger
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.