First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Possibility for funds to remain stucked in Dussehra contract because no RAM was selected.

enchev

Summary

It's possible to not select ram for the event which makes withdrawing funds from the Dussehra contract impossible.

Vulnerability Details

That's possible because

  • the ChoosingRam::increaseValuesOfParticipants function does not set to truethe state variable ChoosingRam::isRamSelected when Ram NFT is maxed.
    The problem is that the Dussehra::killRavana function check if the value of ChoosingRam::isRamSelected is true. And if it remains false when maxing NFT and organiser does not select random NFT (which he/she shouldn't if there is maxed NFT), then it's imposible to execute the logic in Dussehra::killRavana which sends 50 % of the deposits to the organiser. It also makes it impossible for anyone to call Dussehra::withdraw since there is no winner.

  • Even if the above problem was fixed, if noone maxes Ram NFT and the organiser does not call the method ChoosingRam::selectRamIfNotSelected in the time range Oct 12 2024 00:00:00 - Oct 13 2024 00:00:00 as he/she is expected to, then the same impact is achieved.

Impact

Organiser cannot withdraw his funds, nor the selected ram the reward.

Tools Used

Manual Review

Proof Of Concept

  1. Add the following test case to Dussehra.t.sol:

function test_uableToWithdtawFundsFromDussehraContract() public participants {
vm.startPrank(player1);
​
// This has a very high probability (above 95 %) of maxing both participants (0 and 1) NFTs.
for(uint256 i = 0; i < 200; i++) {
choosingRam.increaseValuesOfParticipants(0, 1);
}
vm.stopPrank();
​
// The problem is this:
assertEq(choosingRam.isRamSelected(), false);
​
// And causes this:
vm.expectRevert("Ram is not selected yet!");
dussehra.killRavana();
}```
​
2) Run the following command: `forge test --mt test_uableToWithdtawFundsFromDussehraContract`
​
## Recommendations
Update `ChoosingRam::isRamSelected`inside `ChoosingRam::increaseValuesOfParticipants` when NFT is maxed:
​
```diff
ramNFT.updateCharacteristics(tokenIdOfChallenger, true, true, true, true, true);
selectedRam = ramNFT.getCharacteristics(tokenIdOfChallenger).ram;
+ isRamSelected = true;
ramNFT.updateCharacteristics(tokenIdOfAnyPerticipent, true, true, true, true, true);
selectedRam = ramNFT.getCharacteristics(tokenIdOfAnyPerticipent).ram;
+ isRamSelected = true;

(Optionally) Also you could consider either removing the revert which triggers for data after 13th of October inDussehra::selectRamIfNotSelected in case organiser forgets to call the method in the necessary time period or add some emergency function which could fix that case.

- if (block.timestamp > 1728777600) {
- revert ChoosingRam__EventIsFinished();
- }
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Invalid - `selectRamIfNotSelected` is not called

The organizer is trusted and he/she will call the `selectRamIfNotSelected`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.