Submission Details
Severity:
Challenger can battle for free until the battle is won without risking funds
Summary
The challenger faces no risk; they can mint a Rapper and have it battle the current defender until they win the bet.
Vulnerability Details
The challenger can fight and bet without risking funds. There is no check if the challenger owns the _credBet tokens. So its a free risk bet.
Impact
The funds from the defender can be stolen without risking the challenger funds.
Tools Used
Manual review, VSCode
Recommendations
Add a check if the challenger owns the tokens. If not, simply revert the transaction. If the challenger loses, the tokens are sent to the defender.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
missing check for sufficient `_credBet_` approval
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.