AI Arena - 0brxce's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/MergingPool.sol#L139-L167

Vulnerability details

Impact

claimRewards lacks the proper validation for winners, resulting in a winner potentially being able to call the function multiple times and mint a new fighter.

Proof of Concept

This vulnerability exists whether you've won and claimed a round but for this example you haven't. Given you've never won and claimed a round, and there have been 2 rounds thus far. If you win in round 3, you are able to call claimRewards successfully 3 times.

This is because the lowerBound is set by the number of rounds you've won and claimed. https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/MergingPool.sol#L148-L149

As a result you'll pass the subsequent checks given msg.sender is in winnerAddress[currentRound][j] https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/MergingPool.sol#L151

Tools Used

Manual Review

Recommended Mitigation Steps

Implement a check that limits the amount of times a winner can call claimReward to the amount of rewards they have unclaimed

Assessed type

Invalid Validation