First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

A user can have two different addresses and guarantee a win

yaioxy

Summary

A User can call Dussehra::enterPeopleWhoLikeRam function with 2 different addresses, then call ChoosingRam::increaseValuesOfParticipants and he'll win either way.

Vulnerability Details

  1. A user can enterPeopleWhoLikeRam with 2 different addresses, paying entranceFee twice.

  2. Call ChoosingRam::increaseValuesOfParticipants function multiple times, setting the parameters with his 2 ID tokens.

  3. Ending being the selected Ram with one of his 2 tokens.

  4. Gaining more than entranceFee amount x 2, since there are possibly more people who have entered.

Impact

A guaranteed win for the user.

Tools Used

Manual Review

Recommendations

Implement a system to prevent users from gaining an unfair advantage.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
yaioxy Submitter
over 1 year ago
bube Lead Judge
over 1 year ago
bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.