First Flight #10: One Shot

Summary

Very high waiting time to participate in Rap Battles due to no limit in betting.

Vulnerability Details

There is no limit to how bigger can _credBet get and CredToken have limited supply, i.e., you can only get max 1 CredToken per day.
After a few dozen battles, bets can become as high as 10 or 20 credTokens.

Once a user become defender with high bet like 20 credTokens, new users would have to wait for 20 days before they can participate in battle.
Losers of the rap battles with high bets will also need to wait for much larger amount of days to battle again.

Impact

Waiting time can become very large for new users and losers without fixing the upper limit that you can bet in rap battles.
This will also discourage old users to make a higher bet in the risk of losing their credTokens.

Ways to fix this issue -

1. Set a limit to betting in rap battles.

2. Make many different rap battles with different difficulties.

3. Higher difficulty rap battles will require a minimum number of battles won using battlesWon and higher bets as a starting point.

In this way, there can be numerous rap battles such as small rap battles will require smaller bets. Bigger battles will require bigger bets and a minimum number of battles won by the participants to participate.

Tools Used

Manual Review

Recommendations

Set a limit to the bets in rap battles.