Root + Impact

Description

• The unstake function is called sending the rapper token and earned CRED tokens to the player.

• Lack of proper access control can lead to a DOS attack.

Risk

Likelihood:

• There's no direct risk. This is because although the module_owner address is not verified the internal coin::mint function responsible for minting ensures that only battle_addr can call the mint function. However, there is a chance for a DOS attack, which would hinder legitimate users from making transactions. Ultimately, all the transactions would because coin::mint can handle that.

Impact:

• A DOS attack could prevent legitimate users from making transactions.

Proof of Concept
N/A

Recommended Mitigation

In the unstake function add the following assertion below the token_id/3rd line: