First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Logic error in 'ChoosingRam__increaseValuesOfParticipants()'

DanielEth

Summary

The function 'increaseValuesOfParticipants' in 'ChoosingRam' might only returns errors and has not a correct function.

Vulnerability Details

In the detail, this function might be callable by the users to update their nfts, the problem here is that when they become ram, the variable 'isRamSelected' is not updated, so will be called (necessary) the function 'selectRamIfNotSelected' and a new ram will be randomly selected.

##PoC

function test_badLogicIncreasingValuesOfPartcipants() public {
vm.startPrank(address(this));
ramNft.setChoosingRamContract(address(choosingRam));
vm.stopPrank();
​
address casualAddress1 = address(123);
vm.startPrank(casualAddress1);
ramNft.mintRamNFT(casualAddress1);
vm.stopPrank();
​
address casualAddress2 = address(124);
vm.startPrank(casualAddress2);
ramNft.mintRamNFT(casualAddress2);
vm.stopPrank();
​
address casualAddress3 = address(125);
vm.startPrank(casualAddress3);
ramNft.mintRamNFT(casualAddress3);
​
address casualAddress4 = address(126);
vm.startPrank(casualAddress4);
ramNft.mintRamNFT(casualAddress4);
choosingRam.increaseValuesOfParticipants(3, 0);
choosingRam.increaseValuesOfParticipants(3, 0);
choosingRam.increaseValuesOfParticipants(3, 0);
choosingRam.increaseValuesOfParticipants(3, 0);
choosingRam.increaseValuesOfParticipants(3, 0);
address selectedRam = choosingRam.selectedRam();
assertNotEq(selectedRam, 0x0000000000000000000000000000000000000000);
assertEq(false, choosingRam.isRamSelected());
vm.warp(1728691200);
vm.stopPrank();
​
vm.startPrank(address(this));
choosingRam.selectRamIfNotSelected();
assertEq(true, choosingRam.isRamSelected());
}

Impact

The impacts here are differents and this may leads to others minor bugs (like a bad nft assignment to the users). The major problem is that for users makes no sense call the function 'increaseValuesOfParticipants' (if not for update in a bad way their nfts characteristics.

Tools Used

Manual review

Recommendations

When a ram is selected using the function 'increaseValuesOfParticipants' simply set to 'true' also the variable 'isRamSelected'.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`isRamSelected` is not set

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.