First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Transfering RamNft doesn't update the ram charateristic

waydou

Summary

Transfering RamNft doesn't update the ram charateristic

Vulnerability Details

The current implementation of the RamNFT contract does not update the ram characteristic to reflect the new owner when an NFT is transferred. This oversight allows the previous owner to potentially exploit the system for unfair benefits.

function testWrongCharacteristics() public participants {
// Assume player1 owns the NFT with tokenId 0
uint256 tokenIdOfPlayer1 = 0;
​
// Transfer the NFT to player3
vm.startPrank(player1);
ramNFT.safeTransferFrom(player1, player3, tokenIdOfPlayer1);
vm.stopPrank();
​
// Check if the NFT is transferred
address newOwner = ramNFT.ownerOf(tokenIdOfPlayer1);
assertEq(newOwner, player3, "Ownership of the NFT with id 0 should be player3");
​
// Check the characteristics of the NFT
RamNFT.CharacteristicsOfRam memory characteristics = ramNFT.getCharacteristics(tokenIdOfPlayer1);
assertEq(characteristics.ram, player1, "Characteristics of the NFT with id 0 should reflect player3");
}

Impact

  • UserA enters Dussehra::enterPeopleWhoLikeRam and receives NFT with tokenID 'X'

  • UserA decides he like Ravana more and transfer his NFT with tokenId 'X' to UserB.

  • Organizer picks the NFT with tokenId 'X' but instead of selecting UserB he selects UserA as Ram.

  • UserA wins half the pot after killing Ravana (traitor)

Tools Used

Manual review, foundry

Recommendations

Override the _beforeTokenTransfer method to update the ram attribute whenever an NFT is transferred. This will ensure that the correct owner is recognized, preventing exploitation due to outdated characteristics.

function _beforeTokenTransfer(
address from,
address to,
uint256 tokenId
) internal override {
super._beforeTokenTransfer(from, to, tokenId);
if (from != address(0) && to != address(0)) {
_characteristics[tokenId].ram = to;
}
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.