First Flight #17: Dussehra

Vulnerability Details

the checks if (tokenIdOfChallenger >= ramNFT.tokenCounter()) and if (tokenIdOfAnyParticipant >= ramNFT.tokenCounter()) do not consider the case where ramNFT.tokenCounter() is zero. If ramNFT.tokenCounter() returns zero, any token ID will be considered valid, which is incorrect.

Impact

Suppose ramNFT.tokenCounter() is zero, indicating that no tokens have been minted yet. In this case, the checks as they stand will allow any - tokenIdOfChallenger or tokenIdOfAnyParticipant to be considered valid:

• ramNFT.tokenCounter() returns 0.
  Any tokenIdOfChallenger or tokenIdOfAnyParticipant (e.g., 1, 2, 3) will be valid because tokenId >= 0 is false for all positive integers.
  This will cause the function to proceed with invalid token IDs, leading to unexpected behavior and potential exploits.

Tools Used

none

Recommendations

To prevent this issue, the token ID validity checks should be updated to ensure that ramNFT.tokenCounter() is greater than zero and that the token ID is within the valid range.