First Flight #10: One Shot

Summary

getRapperSkill function gives unfair advantage

Vulnerability Details

Default value of finalSkill variable in getRapperSkill function is 65, i.e., for any Rapper NFT that is uninitialized, it's finalSkill will be 65 as compared to initialized NFTs whose finalSkill will be 50.

Using bug present in _battle function, attacker can use uninitialized NFT's tokenId to gain higher rapperSkill without staking.
This gives the attacker an unfair advantage as compared to defender.

Impact

Users can get higher rapperSkill without participating in staking.

Tools Used

Manual Review