First Flight #17: Dussehra

Summary

Lack of updating ChoosingRam::isRamSelected variable in the ChoosingRam::increaseValuesOfParticipants function allows for overwriting players as Ram, because the ChoosingRam::RamIsNotSelected modifier is not triggered.

Vulnerability Details

After updating all characteristics of a Ram NFT with ChoosingRam::increaseValuesOfParticipants and getting stored as ChoosingRam::selectedRam, there's no updating ChoosingRam::isRamSelected to true, which allows for other calls to ChoosingRam::increaseValuesOfParticipants to the highest update to overwrite the players address as ChoosingRam::selectedRam.

Impact

No player is assured its victory, even when being selected as Ram, which breaks the purpose of the protocol.

Tools Used

Manual review

Recommendations

Add isRamSelected = true; after both selectedRam = ramNFT.getCharacteristics(tokenIdOfChallenger).ram; lines in the ChoosingRam::increaseValuesOfParticipants function.