Submission Details
Severity:
In `RamNFT.sol` an arbitrary address is used , instead of using `ChoosingRam` address in `setChoosingRamContract` function
Summary
-->> address public choosingRamContract;
-->> function setChoosingRamContract(address _choosingRamContract) public onlyOrganiser {
choosingRamContract = _choosingRamContract;
}
Impact
Any arbitrary address can become the ChoosingRam contract and thus can do malicious things in the contract for their benefit.
Tools Used
Manual Review
Recommendations
In RamNFT.sol do this
+ import {ChoosingRam} from "./ChoosingRam .sol";
- address public choosingRamContract;
+ ChoosingRam public choosingRamContract;
- function setChoosingRamContract(address _choosingRamContract) public onlyOrganiser {
choosingRamContract = _choosingRamContract;
}
+ function setChoosingRamContract(ChoosingRam _choosingRamContract) public onlyOrganiser {
choosingRamContract = _choosingRamContract;
}
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.