First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Duplicate Token Participation Leads to Unfair Advantage and Centralization

chaossr

Summary

In the increaseValuesOfParticipants function of the smart contract, there is a vulnerability that allows the same token ID to participate multiple times. This could lead to unfair advantages and potential manipulation of the contract's logic, which is supposed to enhance the characteristics of different participants based on a random process.

Vulnerability Details

The function increaseValuesOfParticipants does not include a mechanism to ensure that each token ID can only participate once. As a result, the same token ID can be used repeatedly to potentially enhance its characteristics or achieve the status of "selectedRam". This flaw undermines the intended fairness of the random enhancement process.
The function currently only checks if the token IDs are valid and if the caller is the owner of the tokenIdOfChallenger. It does not track whether a token ID has already participated, allowing the same token ID to be used multiple times.

Impact

Unfair Advantage, Participants can repeatedly use the same token ID to maximize its characteristics unfairly.

Tools Used

Manual code Review

Recommendations

Introduce a mapping to track participation status for each token ID to ensure that each token can only participate once.

++ mapping(uint256 => bool) private hasParticipated;
function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
if (ramNFT.getCharacteristics(tokenIdOfChallenger).ram != msg.sender) {
revert ChoosingRam__CallerIsNotChallenger();
}
if (block.timestamp > 1728691200) {
revert ChoosingRam__TimeToBeLikeRamFinish();
}
++ if (hasParticipated[tokenIdOfChallenger] || hasParticipated[tokenIdOfAnyPerticipent]) {
revert ChoosingRam__TokenIdAlreadyParticipated();
}
​
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender))) % 2;
​
if (random == 0) {
// Enhancement logic for tokenIdOfChallenger
hasParticipated[tokenIdOfChallenger] = true;
} else {
// Enhancement logic for tokenIdOfAnyPerticipent
hasParticipated[tokenIdOfAnyPerticipent] = true;
}
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Challenge themselves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.