AI Arena - 0xShitgem's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L370

Vulnerability details

Impact

reRoll function accepts below parameters

/// @notice Rolls a new fighter with random traits.
/// @param tokenId ID of the fighter being re-rolled.
/// @param fighterType The fighter type.
function reRoll(uint8 tokenId, uint8 fighterType) public {}

In programming uint8 is described as 8-bit unsigned integer and the maximum value of this integer is 255. That means that any number above 255 passed as parameter would revert.

Impact: Users with NFTs above 255 won't be able to execute this function

Proof of Concept

You can paste following into FigherFarm.t.sol:

function testTokenId() public {
    _fighterFarmContract.reRoll(256, 0);
}

And it wouldn't even compile throwing this error: Invalid type for argument in function call. Invalid implicit conversion from int_const 256 to uint8 requested. Literal is too large to fit in uint8.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider changing from uint8 to uint256.

Assessed type

Error