Closed c4-bot-5 closed 8 months ago
raymondfam marked the issue as sufficient quality report
raymondfam marked the issue as duplicate of #53
HickupHH3 changed the severity to 3 (High Risk)
HickupHH3 marked the issue as satisfactory
HickupHH3 changed the severity to 2 (Med Risk)
HickupHH3 marked the issue as duplicate of #376
Lines of code
https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L214-L214 https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L324-L324
Vulnerability details
Impact
The physical attributes of Fighter NFTs have rarity, and typically the greater the scarcity, the greater the implied relative value.
FighterFarm
has three functions for minting Fighters, and besides the special case for mint passes (that has a limited run), the other function two functions are expected to adhere to the rarities for Fighter physical attributes (using pseudo randomness).A Player can manipulate the generated value, breaking the randomness invariant, and transitively the scarcity of Fighter physical attributes, by selecting their rarity.
Proof of Concept
The calculation of the physical attribute rarity can be controlled by the Player, by choosing the timing of their Fighter NFT minting to generate the DNA they desire.
Physical attributes have rarity
Each of the Fighter's physical attributes are randomized and has a rarity associated as described in the AI Arena NFT Makeup - The Skin docs
DNA determines physical attribute rarity
All paths to create a Fighter NFT share the common function FighterFarm::_createNewFighter() that accepts a
dna
parameter that generate the physical attributes with AiArenaHelper::createPhysicalAttributes() that acceptsdna
Outside the special case of
iconsType
,dna
is used in conjunction with an array of prime numbers to determine rarityAs the elements of
attributeToDnaDivisor
are known (public data), when you know thedna
value, you can calculate the rarity for each of the physical attributes.Controlling the DNA
In FighterFarm::claimFighters() and FighterFarm::mintFromMergingPool() the same technique is used to calculate
dna
The Player can calculate the
dna
value and resulting physical rarities off-chain, as all the data is available.As the Player controls when the mint function is called, they can simply wait on other Players to create Fighters (and increase
fighters.length
), until thedna
value on their mint will create favourable physical attributes.Tools Used
Manual review
Recommended Mitigation Steps
Ensure consistent Fighter
dna
by using input that the receiver cannot manipulate.Add aew mapping for number of mints for a receiver address, and use that total in combination with the receiver address for the
dna
in FighterFarmAssessed type
Other