First Flight #10: One Shot

Summary

Malicious user can block people enter battle via frontrun

Vulnerability Details

When challenger wants to participate one battle, he need to use the same number of credit Tokens. If the amount of credit tokens is different, challenger's request will be reverted. So malicious user monitor user's battle request with one specific amount of credit Token. Malicious user can be one defender with one different amount of credit Token via frontrun.

For example:

• Contract has no any defender now.

• Alice want to be one defender and start one battle with 100 cred Tokens.

• Bob monitor this, and start one battle with 50 cred Tokens via frontrun to become the defender.

• Alice's request will be rejected.

Impact

Malicious users can block people participate battles.

Tools Used

Manual

Recommendations

Consider using the same amount of cred tokens.