One Shot: Reloaded
First Flight #47
Beginner FriendlyNFT
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

No range for betting allow for mis-use of battles that can DoS the protocol

Author Revealed upon completion

Root + Impact

Description

There are no range of bet available for battling. This can create abuses where a player spams 0 amount bets as a defender, of bet a very high amount, for which other users may lack the funds to contest as a challenger.

Because the protocol only has 1 arena to battle in, users won't be able to have a battle that matches their criterias.

public entry fun go_on_stage_or_battle(
player: &signer,
rapper_token: Object<Token>,
bet_amount: u64
) acquires BattleArena {
let player_addr = signer::address_of(player);
let arena = borrow_global_mut<BattleArena>(@battle_addr);
​
if (arena.defender == @0x0) {
assert!(arena.defender_bet == 0, E_BATTLE_ARENA_OCCUPIED);
// @audit No min/max amount for bet
arena.defender = player_addr;
@> arena.defender_bet = bet_amount;

Risk

Likelihood:

This may occur if a user choose to grief the game.

It may also occur on itslef if a defender bets too high and no one else wants to match the bid. They won't be able to change their bid in this case and the protocol will be stuck in an unwanted state.

Impact:

Users loose interest in the protocol.

DoS of the protocol.

Recommended Mitigation

Place a minimum and maximum amount for bets, or create different stages for different kinds of bets.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.