First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

User can challange themselves and win in every senario

yaioxy

Summary

In the ChoosingRam::increaseValuesOfParticipants function, a user can challenge themselves by setting the same token ID for both the challenger and the participant, leading to a guaranteed win in every scenario.

Vulnerability Details

The function allows a user to pass the same token ID for both tokenIdOfChallenger and tokenIdOfAnyPerticipent. This issue enables the user to always win since the random selection process does not differentiate between the challenger and the participant when they are the same entity. The user has just
to call the function again and again with the same parameters to guarantee a win.

Proof of Concept

Use this test in the Dussehra.t.sol

function test_sameTokenId() public participants {
vm.startPrank(player1);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
choosingRam.increaseValuesOfParticipants(0, 0);
vm.stopPrank();
​
assertEq(choosingRam.selectedRam(), player1);
}

Impact

Users can exploit this vulnerability to always win.

Tools Used

Manual Review

Recommendations

Add a check to ensure that tokenIdOfChallenger and tokenIdOfAnyPerticipent are not the same. If they are, revert the transaction to prevent self-challenging.

+ error ChoosingRam__SelfChallengingNotAllowed();
​
function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
if (tokenIdOfChallenger > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfChallenger();
}
if (tokenIdOfAnyPerticipent > ramNFT.tokenCounter()) {
revert ChoosingRam__InvalidTokenIdOfPerticipent();
}
if (ramNFT.getCharacteristics(tokenIdOfChallenger).ram != msg.sender) {
revert ChoosingRam__CallerIsNotChallenger();
}
+ if (tokenIdOfChallenger == tokenIdOfAnyPerticipent) {
+ revert ChoosingRam__SelfChallengingNotAllowed();
+ }
.
.
.
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Challenge themselves

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!