First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`ChoosingRam::increaseValuesOfParticipants` doesn't set `isRamSelected` to `true` when the `selectedRam` is chosen, making the `selectedRam` can not kill Ravana and withdraw reward.

kazan

Description

In ChoosingRam contract, the increaseValuesOfParticipants function allows users to increase their values(or characteristics) and become Ram for the event and never update the values again after 12th October 2024.
Follow the code, when a ramNFT have all 5 last characteristics is set to true, its owner address will become Ram and can kill Ravana then can withdraw reward. However, although the selectedRam value is set in this function, the value of isRamSelected isn't set to true.

Impact

When time come, user can not call killRavana function in Dussehra contract because the RamIsSelected modifier will revert. User will lost his/her reward. Plus the RamIsNotSelected modifier in ChoosingRam contract still allow the organiser to call selectRamIfNotSelected to select another Ram.

Tools Used

  • Manual review

  • Foundry

PoC

Place this test in Dussehra.t.sol

function test_winnerOfIncreaseValuesOfParticipantsToSelectRamCanNotKillRavana() public participants {
vm.startPrank(player1);
choosingRam.increaseValuesOfParticipants(0, 1);
choosingRam.increaseValuesOfParticipants(0, 1);
choosingRam.increaseValuesOfParticipants(0, 1);
choosingRam.increaseValuesOfParticipants(0, 1);
choosingRam.increaseValuesOfParticipants(0, 1);
​
assertEq(ramNFT.getCharacteristics(1).isSatyavaakyah, true);
​
vm.warp(1728691200 + 1);
vm.expectRevert("Ram is not selected yet!");
dussehra.killRavana();
​
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
}

Test pass. The selected Ram can not kill Ranvana and the organiser select another Ram.

Recommendations

Add isRamSelected = true; under selectedRam setting.

function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
.
.
.
selectedRam = ramNFT.getCharacteristics(tokenIdOfChallenger).ram;
+ isRamSelected = true;
}
} else {
.
.
.
selectedRam = ramNFT.getCharacteristics(tokenIdOfAnyPerticipent).ram;
+ isRamSelected = true;
}
}
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`isRamSelected` is not set

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.