First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Challenger passing same tokenId in `ChoosingRam::increaseValuesOfParticipants` for the participant will make them always win

shikhar229169

Summary

The increaseValuesOfParticipants allows the challenger to challenger any participant, and winner gets a characteristic unlocked, but a challenger challenging their own tokenId will make them always win, as both challenger and participants corresponds to the same tokenId, therefore making the challenger to always win and making it unfair for other players.

Vulnerability Details

The vulnerability is present in the increaseValuesOfParticipants function where it doesn't ensure that the participant tokenId is different from the challenger tokenId, therefore allowing the challenger to execute it with the participant tokenId same as the challnger making them to always win.

As both challenger and participant tokenId are same, therefore no matter what is the result it will go for the same tokenId.

Impact

Challenger will always win, making it unfair for other participants.

PoC

Add the test in the file: test/Dussehra.t.sol

Run the test:

forge test --mt test_challengerPassingSameTokenAsParticipantMakesThemAlwaysWin
function test_challengerPassingSameTokenAsParticipantMakesThemAlwaysWin() public {
uint256 tokenId = ramNFT.getNextTokenId();
​
vm.startPrank(player1);
vm.deal(player1, 1 ether);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.stopPrank();
​
// initially isJitaKrodhah would be false, but after first participation it will be true
assertEq(ramNFT.getCharacteristics(tokenId).isJitaKrodhah, false);
​
vm.startPrank(player1);
​
// passing tokenId of other participant same as challenger
choosingRam.increaseValuesOfParticipants(tokenId, tokenId);
vm.stopPrank();
​
assertEq(ramNFT.getCharacteristics(0).isJitaKrodhah, true);
}

Tools Used

Manual Review, Unit Test in Foundry

Recommendations

Add a check to ensure that the participant's tokenId passed by challenger is not same as the challenger's in the ChoosingRam::increaseValuesOfParticipants function.

+ error ChoosingRam__BothTokenIdShouldBeDifferent();
​
+ if (tokenIdOfChallenger == tokenIdOfAnyPerticipent) {
+ revert ChoosingRam__BothTokenIdShouldBeDifferent();
+ }
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Challenge themselves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.