First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing input validation - `increaseValuesOfParticipants` function does not check if `tokenIdOfAnyPerticipent` matches `tokenIdOfChallenger`.

0x1912

Summary

increaseValuesOfParticipants function does not check if tokenIdOfAnyPerticipent matches tokenIdOfChallenger.

Vulnerability Details

increaseValuesOfParticipants function checks only if tokenIdOfChallenger and tokenIdOfAnyPerticipent are valid token ID.

function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
}
​
__SNIP__
}

Therefore, users can input tokenIdOfAnyPerticipent same as tokenIdOfChallenger.
If tokenIdOfAnyPerticipent equals tokenIdOfChallenger, then users can increase his NFT value regardless of random value.

So users can call this function five times with tokenIdOfAnyPerticipent param same as tokenIdOfChallenger to become selected ram.

for (uint i = 0; i < 5; i++) {
chossingRam.increaseValuesOfParticipants(senderNftId, senderNftId);
}

Impact

Users can easily become selected Ram bypassing random functionality.

Tools Used

Manual review

Recommendations

Please revert if tokenIdOfChallenger equals to tokenIdOfAnyPerticipent

function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
++ if (tokenIdOfAnyPerticipent == tokenIdOfChallenger ) {
++ revert ChoosingRam__invalidTokenIdOfPerticipent();
++ }
​
__SNIP__
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Challenge themselves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.