First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Status of Selection of Ram `isRamSelected` isn't updated in `ChoosingRam::increaseValuesOfParticipants`.

waydou

Summary

Dussehra::killRavana can be called twice and by anyone, and is subject to reentrancy attack

Vulnerability Details

Dussehra::killRavana can be called twice and by anyone, This allows any user or a malicious organizer to call the function again after killin Ravana the first time, leading to the organizer receiving the entire pot and for Ram to lose acces to their rewards.

There's also another vulnerability present, which is the reentrancy attack that can be done by a malicious orrganizer as the Code doesn't follow CEI best practices

Impact

This vulnerability undermines the integrity of the event, as participants might lose trust in the fairness of the system. Potential participants may decide not to join the event, leaving Ravana undefeated and the event unsuccessful.

function test_killRavanaTwice() public participants {
address malicious_user = makeAddr("malicious_user");
vm.warp(1728691200 + 1);
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
assertEq(choosingRam.selectedRam(), player2);
​
vm.startPrank(player2);
dussehra.killRavana(); // kill Ravana first time
vm.stopPrank();
​
vm.startPrank(malicious_user);
dussehra.killRavana(); // kill Ravana second time
vm.stopPrank();
​
vm.startPrank(player2);
vm.expectRevert("Failed to send money to Ram"); // will revert because the money has already been claimed
dussehra.withdraw();
vm.stopPrank();
​
uint256 RamwinningAmount = dussehra.totalAmountGivenToRam();
assertEq(organiser.balance, 2 * RamwinningAmount); // organizer wins all the pot
}

Tools Used

Foundry

Recommendations

Add RavanKilled Modifier this serves as a Reentrancy guard:

- function killRavana() public RamIsSelected {
+ function killRavana() public RamIsSelected RavanKilled {
if (block.timestamp < 1728691069) {
revert Dussehra__MahuratIsNotStart();
}
if (block.timestamp > 1728777669) {
revert Dussehra__MahuratIsFinished();
}
IsRavanKilled = true;
uint256 totalAmountByThePeople = WantToBeLikeRam.length * entranceFee;
totalAmountGivenToRam = (totalAmountByThePeople * 50) / 100;
(bool success, ) = organiser.call{value: totalAmountGivenToRam}("");
require(success, "Failed to send money to organiser");
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

isRavanKilled is not checked

waydou Submitter
about 1 year ago
bube Lead Judge
about 1 year ago
bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

isRavanKilled is not checked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.