First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

The Dussehra Event Can Be Griefed by Any User

vile

Summary

Dussehra::killRavana does not implement a check to see if it has already been called, allowing any user to call the function twice, sending the entire balance of the contract to the organiser

Vulnerability Details

A check does not exist in the Dussehra::killRavana function to see if IsRavanKilled is already set to true. This allows killRavana to be called repeatedly.

Impact

Any user can call killRavana twice, sending the entire contract's balance to the organiser, preventing the selectedRam from calling withdraw and receiving their allocated ETH.

Tools Used

Manual Review

Recommendations

killRavana should implement a check to see if IsRavanKilled is already set to true.

+ modifier RavanNotKilled() {
+ require(!IsRavanKilled, "Ravan has already been killed!");
+ _;
+ }
​
// ...
​
- function killRavana() public RamIsSelected {
+ function killRavana() public RamIsSelected RavanNotKilled {
// ...
IsRavanKilled = true;
// ...
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

isRavanKilled is not checked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.