First Flight #17: Dussehra

Summary

In ChoosingRam::increaseValuesOfParticipants users can pass the same tokenID.

Vulnerability Details

ChoosingRam::increaseValuesOfParticipants includes a conditional check based on a random value (0 or 1), which determines if the user's Ram NFT is improved or another participants. However, Malicious users can pass the same tokenID for tokenIdOfChallenger and tokenIdOfAnyPerticipent, thus, guaranteeing regardless of the random result, their NFT will be selected to be improved.

Impact

This effectively makes it a gas war for who can call this function the quickest and passing their own token ID for both tokenIdOfChallenger and tokenIdOfAnyPerticipent, rendering the protocol worthless.

Tools Used

Unit test

    function test_increaseValuesOfParticipantsCanPassSameTokenId()
        public
        participants
    {
        vm.startPrank(player1);
        choosingRam.increaseValuesOfParticipants(0, 0);
        choosingRam.increaseValuesOfParticipants(0, 0);
        choosingRam.increaseValuesOfParticipants(0, 0);
        choosingRam.increaseValuesOfParticipants(0, 0);
        choosingRam.increaseValuesOfParticipants(0, 0);
        vm.stopPrank();
    assertEq(ramNFT.getCharacteristics(0).isJitaKrodhah, true);
    assertEq(ramNFT.getCharacteristics(0).isDhyutimaan, true);
    assertEq(ramNFT.getCharacteristics(0).isVidvaan, true);
    assertEq(ramNFT.getCharacteristics(0).isAatmavan, true);
    assertEq(ramNFT.getCharacteristics(0).isSatyavaakyah, true);
}

Recommendations

Add an additional check in ChoosingRam::increaseValuesOfParticipants that the tokenIDs are not the same.