Open c4-bot-4 opened 8 months ago
raymondfam marked the issue as insufficient quality report
raymondfam marked the issue as duplicate of #17
raymondfam marked the issue as not a duplicate
raymondfam marked the issue as duplicate of #212
raymondfam marked the issue as sufficient quality report
This report covers three consequences from the same root cause of fighter type validation: 1. more re-rolls, 2. rarer attribute switch, 3. generation attribute switch, with coded POC.
raymondfam marked the issue as not a duplicate
raymondfam marked the issue as primary issue
brandinho (sponsor) confirmed
HickupHH3 marked the issue as selected for report
HickupHH3 changed the severity to 3 (High Risk)
Mitigated here
Lines of code
https://github.com/code-423n4/2024-02-ai-arena/blob/1d18d1298729e443e14fea08149c77182a65da32/src/FighterFarm.sol#L372
Vulnerability details
Impact
Can reroll attributes based on a different fighterType, and can bypass maxRerollsAllowed.
Proof of Concept
maxRerollsAllowed
can be set differently depending on thefighterType
. Precisely, it increases as the generation of fighterType increases.The
reRoll
function does not verify if thefighterType
given as a parameter is actually thefighterType
of the given tokenId. Therefore, it can use either 0 or 1 regardless of the actual type of the NFT.This allows bypassing
maxRerollsAllowed
for additional reRoll, and to call_createFighterBase
andcreatePhysicalAttributes
based on a differentfighterType
than the actual NFT'sfighterType
, resulting in attributes calculated based on different criteria.This is PoC.
First, there is a bug that there is no way to set
numElements
, so add a numElements setter to FighterFarm. This bug has been submitted as a separate report.Add a test to the FighterFarm.t.sol file and run it. The generation of Dendroid has increased, and
maxRerollsAllowed
has increased. The user who owns the Champion NFT bypassedmaxRerollsAllowed
by putting thefighterType
of Dendroid as a parameter in thereRoll
function.Tools Used
Manual Review
Recommended Mitigation Steps
Check
fighterType
at reRoll function.Assessed type
Invalid Validation