Submission Details
Severity:
Lack of `onlyChoosingRamContract` Modifier on `updateCharacteristics` Calls
Summary
Allowing unauthorized access to updateCharacteristics can lead to unintended changes in the NFT characteristics, which could undermine the integrity of the event and the contract’s logic. Ensuring only the ChoosingRam contract can call this function is important for security.
Vulnerability Details
+ event CharacteristicsUpdated(uint256 tokenId, address updatedBy);
+ event RamSelected(address selectedRam);
function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
...
+ emit CharacteristicsUpdated(tokenIdOfChallenger, msg.sender);
...
}
function selectRamIfNotSelected() public RamIsNotSelected OnlyOrganiser {
...
+ emit RamSelected(selectedRam);
}
Impact
This could lead to unauthorized calls to updateCharacteristics.
Tools Used
Manual review
Recommendations
Add the necessary checks or modifiers to ensure only ChoosingRam can call updateCharacteristics.
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.