First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Can challenge yourself to guarantee being selectedRam

mattjenkins

Summary

When you have entered as a person who likes Ram, it is possible to call the increaseValuesOfParticipants function on the ChoosingRAM contract with yourself as the challenger. This means that whatever the outcome, you are the NFT who levels up. An NFT owner therefore can break the protocol by ensuring that they are the selected Ram at any point they want.

Vulnerability Details

​
function test_increaseValuesOfParticipantsToSelectRamYourself() public participants {
​
vm.startPrank(player1);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
vm.stopPrank();
​
assertEq(ramNFT.getCharacteristics(0).isJitaKrodhah &&
ramNFT.getCharacteristics(0).isDhyutimaan &&
ramNFT.getCharacteristics(0).isVidvaan &&
ramNFT.getCharacteristics(0).isAatmavan &&
ramNFT.getCharacteristics(0).isSatyavaakyah
, true);
​
assertEq(choosingRam.selectedRam(), player1);
}

Impact

The protocol is in effect ruined at this point because once an NFT holder has increased themselves to isSatyavaakyah status, they need to do a single call to ensure that they are the selected Ram and win. This could be done by front-running the selectRamIfNotSelected function when called by the organiser and ensuring that when the competition ends, the NFT holder will be the selected Ram.

Tools Used

foundry + manual review.

Recommendations

The organiser could use a hidden mempool provider like Flashbots to ensure that NFT holders couldn't see the transaction in the mempool, and also put in a check in the increaseValuesOfParticipants function in the ChoosingRam contract to make sure that you can't compete against yourself.

+ error ChoosingRam__ChallengerMustBeDifferent();
​
+ if (tokenIdOfChallenger == tokenIdOfAnyPerticipent) {
+ revert ChoosingRam__ChallengerMustBeDifferent();
+ }
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Challenge themselves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.