Submission Details
Impact:
Likelihood:
No Minimum Bet Amount in Battles
Root + Impact
Description
-
Bets should have a minimum to ensure economic stake.
-
The specific issue is bet_amount can be 0, allowing spam or trivial battles.
// In rap_battle.move
public entry fun go_on_stage_or_battle(
// ...
bet_amount: u64
//@> // Missing: assert!(bet_amount > 0, E_ZERO_BET);
) acquires BattleArena {
Risk
Likelihood: Medium
User sets bet_amount = 0.
Arena occupied with no-risk battles.
Impact: Low
Spam of arena and events.
Dilution of betting mechanics.
Proof of Concept
Go on stage with bet=0: succeeds, occupies arena cheaply.
#[test(module_owner = @battle_addr, player1 = @0x123, player2 = @0x456)]
fun test_zero_bet_battle(module_owner: &signer, player1: &signer, player2: &signer) acquires battle_addr::rap_battle::BattleArena, battle_addr::one_shot::Collection, battle_addr::one_shot::RapperStats {
// Setup
battle_addr::cred_token::init_module(module_owner);
battle_addr::one_shot::init_module(module_owner);
battle_addr::rap_battle::init_module(module_owner);
// Mint rappers
battle_addr::one_shot::mint_rapper(module_owner, signer::address_of(player1));
battle_addr::one_shot::mint_rapper(module_owner, signer::address_of(player2));
// Go on stage with bet 0
let rapper1 = /* assume */;
battle_addr::rap_battle::go_on_stage_or_battle(player1, rapper1, 0);
// Challenge with bet 0
let rapper2 = /* assume */;
battle_addr::rap_battle::go_on_stage_or_battle(player2, rapper2, 0);
// Battle proceeds with no economic stake
assert!(/* arena cleared, events emitted */, 0);
}
Recommended Mitigation
+ assert!(bet_amount > 0, E_ZERO_BET); // Add minimum check
Updates
Lead Judging Commences
bube 16 days ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
The bet amount can be 0
This is Informational, there is no security impact on the protocol from that.
Rewards breakdown
nSLOC
436This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.