Submission Details
Severity:
In `RamNFT::updateCharacteristics` we can change the `tokenId` also
Summary
function updateCharacteristics(
--> uint256 tokenId,
bool _isJitaKrodhah,
bool _isDhyutimaan,
bool _isVidvaan,
bool _isAatmavan,
bool _isSatyavaakyah
) public onlyChoosingRamContract {
Characteristics[tokenId] = CharacteristicsOfRam({
--> ram: Characteristics[tokenId].ram,
isJitaKrodhah: _isJitaKrodhah,
isDhyutimaan: _isDhyutimaan,
isVidvaan: _isVidvaan,
isAatmavan: _isAatmavan,
isSatyavaakyah: _isSatyavaakyah
});
}
Impact
It may lead to someone changing their tokenId with others , which may lead to confusion nad ownership issues
Tools Used
Manual Review
Recommendations
TokenId should not be updated wuth characteristics
There should be a check that only the owner of that RamNFT is able to change it
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.