Submission Details
Severity:
Transfer of the RamNft
Summary
Transfer of the RamNft does not update the ram characteristics of the NFT.
Vulnerability Details
If the Ram NFT is transfered the ram characteristics is not updated.
Code
function test_transferDoesNotUpdateRam() public participants {
vm.startPrank(player1);
ramNFT.transferFrom(player1, player4, 0);
vm.stopPrank();
assertEq(ramNFT.ownerOf(0), player4);
assertNotEq(ramNFT.getCharacteristics(0).ram, player4);
}
Impact
If the transferred NFT is selected as ram by the ChoosingRam::selectRamIfNotSelected function the reward will go the original owner.
Tools Used
Manual analysis
Recommendations
In the RamNFT::mintRamNFT function the ram characteristics should be set to the owner of the NFT.
uint256 newTokenId = tokenCounter++;
_safeMint(to, newTokenId);
Characteristics[newTokenId] = CharacteristicsOfRam({
- ram: to,
+ ram: ownerOf(newTokenId),
isJitaKrodhah: false,
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.