First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Anyone can call `Dussehra::killRavana` a second time and send the complete contract balance to the `organiser`

codexbugmenot

Summary

The Dussehra::killRavana function should be allowed to be called only once but it can be called multiple times by anyone because of improper checks which sends the whole reward pot to the organiser leaving no rewards for selectedRam

Vulnerability Details

The Dussehra::killRavana function doesn't have any checks that check if Ravan is already killed allowing anyone to call it a second time and withdraw the whole reward pot to the organiser

POC: cannot Withdraw If Ravan Is Killed Twice
​
function test_cannotWithdrawIfRavanIsKilledTwice() public participants {
vm.warp(1728691200 + 1);
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
// player 2 kills ravana
vm.startPrank(player2);
dussehra.killRavana();
vm.stopPrank();
// player 1 kills ravana again
// to grief player 2
vm.startPrank(player1);
dussehra.killRavana();
vm.stopPrank();
// now player2 cannot withdraw his rewards
vm.expectRevert();
vm.startPrank(player2);
dussehra.withdraw();
vm.stopPrank();
}
​

Impact

Anyone can call Dussehra::killRavana a second time which would make the contract balance empty and the actual selectedRam will not be able to withdraw his rewards

Tools Used

  1. Manual Review

  2. Foundry

Recommendations

Adding a new Modifier to check RavanNotKilled in Dussehra::killRavana to check that the function can only be called if Ravan is not killed

make the following changes in Dussehra.sol

  1. Add the modifier

modifier RavanNotKilled() {
require(IsRavanKilled, "Ravan is Already killed !");
_;
}

  1. In the Dussehra::killRavana function

- function killRavana() public RamIsSelected {
+ function killRavana() public RamIsSelected RavanNotKilled {
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

isRavanKilled is not checked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.