One Shot: Reloaded
First Flight #48
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

No range for betting allow for mis-use of battles that can DoS the protocol

strapontin

Root + Impact

Description

There are no range of bet available for battling. This can create abuses where a player spams 0 amount bets as a defender, of bet a very high amount, for which other users may lack the funds to contest as a challenger.

Because the protocol only has 1 arena to battle in, users won't be able to have a battle that matches their criterias.

public entry fun go_on_stage_or_battle(
player: &signer,
rapper_token: Object<Token>,
bet_amount: u64
) acquires BattleArena {
let player_addr = signer::address_of(player);
let arena = borrow_global_mut<BattleArena>(@battle_addr);
​
if (arena.defender == @0x0) {
assert!(arena.defender_bet == 0, E_BATTLE_ARENA_OCCUPIED);
// @audit No min/max amount for bet
arena.defender = player_addr;
@> arena.defender_bet = bet_amount;

Risk

Likelihood:

This may occur if a user choose to grief the game.

It may also occur on itslef if a defender bets too high and no one else wants to match the bid. They won't be able to change their bid in this case and the protocol will be stuck in an unwanted state.

Impact:

Users loose interest in the protocol.

DoS of the protocol.

Recommended Mitigation

Place a minimum and maximum amount for bets, or create different stages for different kinds of bets.

Updates

Lead Judging Commences

bube Lead Judge 21 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

The bet amount can be 0

This is Informational, there is no security impact on the protocol from that.

Appeal created

strapontin Submitter
21 days ago
bube Lead Judge
19 days ago
bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

The bet amount can be 0

This is Informational, there is no security impact on the protocol from that.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.