First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`ChoosingRam::isRamSelected` Is Never Set to `true` When Calling `ChoosingRam::increaseValuesOfParticipants` Resulting in Unintended Behavior and a Temporary DOS

vile

Summary

During increaseValuesOfParticipants, only selectedRam is set to the winner's address and isRamSelected is not set to true. This allows selectedRam to be overwritten, and creates a temporary DOS to Dussehra::killRavana and Dussehra::withdraw.

Vulnerability Details

When all characteristics are set, only selectedRam is set to the winner's address and isRamSelected is not set to true.

Impact

Due to isRamSelected not being set to true, subsequent calls to increaseValuesOfParticipants are allowed (since the RamIsNotSelected modifier passes), overwriting selectedRam. This is unintended behavior.

Furthermore, a DOS occurs in Dussehra::killRavana and Dussehra::withdraw since the RamIsSelected modifier is unable to pass. This DOS persists until the organiser is able to call ChoosingRam::selectRamIfNotSelected which does set isRamSelected to true. However, this also overwrites selectedRam.

Tools Used

Manual Review

Recommendations

When setting selectedRam, also set isRamSelected to true during increaseValuesOfParticipants calls.

function increaseValuesOfParticipants(uint256 tokenIdOfChallenger, uint256 tokenIdOfAnyPerticipent)
public
RamIsNotSelected
{
// ...
if (random == 0) {
// ...
} else if (ramNFT.getCharacteristics(tokenIdOfChallenger).isSatyavaakyah == false){
ramNFT.updateCharacteristics(tokenIdOfChallenger, true, true, true, true, true);
selectedRam = ramNFT.getCharacteristics(tokenIdOfChallenger).ram;
+ isRamSelected = true;
}
} else {
// ...
} else if (ramNFT.getCharacteristics(tokenIdOfAnyPerticipent).isSatyavaakyah == false){
ramNFT.updateCharacteristics(tokenIdOfAnyPerticipent, true, true, true, true, true);
selectedRam = ramNFT.getCharacteristics(tokenIdOfAnyPerticipent).ram;
+ isRamSelected = true;
}
}
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`isRamSelected` is not set

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.