After a battle, the protocol should return both Rapper NFTs to their owners by transferring the objects back from @battle_addr.
The specific issue is that while internal records are updated, no object::transfer calls are made post-battle to return the NFTs, leaving them custodied at @battle_addr indefinitely without a user-callable retrieval function.
Likelihood:
High
A battle completes successfully.
No post-battle transfer of NFT objects occurs.
Impact:
High
Users cannot access or use their NFTs after battles.
Protocol custody leads to permanent asset lockup without owner intervention.
Go on stage with defender, then challenge with another.
After battle, attempt to use or transfer the NFTs from original addresses: fails as objects are at @battle_addr.
Add after record updates, assuming module_owner signer is passed or accessible:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.