Platform: Code4rena
Start Date: 09/02/2024
Pot Size: $60,500 USDC
Total HM: 17
Participants: 283
Period: 12 days
Judge:
Id: 328
League: ETH
Rank: 24/283
Findings: 2
Award: $246.18
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: nuthan2x
Also found by: 0xE1, 0xblackskull, 0xgrbr, 0xvj, Greed, McToady, MidgarAudits, PetarTolev, Sabit, SovaSlava, SpicyMeatball, Timenov, Tychai0s, _eperezok, alexxander, btk, c0pp3rscr3w3r, favelanky, jesjupyter, josephdara, juancito, klau5, kutugu, lil_eth, merlinboii, pynschon, sandy, shaflow2, zaevlad
7.2869 USDC - $7.29
https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L139-L142
Owner can not remove staker address after giving permission role.
https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L139-L142
Code review
add removeStaker function
function removeStaker(address newStaker) external { require(msg.sender == _ownerAddress); hasStakerRole[newStaker] = false; }
Context
#0 - c4-pre-sort
2024-02-24T06:24:26Z
raymondfam marked the issue as insufficient quality report
#1 - c4-pre-sort
2024-02-24T06:25:13Z
raymondfam marked the issue as duplicate of #20
#2 - c4-judge
2024-03-05T10:04:41Z
HickupHH3 marked the issue as partial-25
🌟 Selected for report: Timenov
Also found by: 0x11singh99, 0xblackskull, CodeWasp, MidgarAudits, MrPotatoMagic, Rolezn, Sabit, SovaSlava, andywer, btk, josephdara, lil_eth, merlinboii, sobieski, vnavascues
238.8948 USDC - $238.89
https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/GameItems.sol#L185-L188
The setAllowedBurningAddresses function in the smart contract lacks a mechanism to revoke permission for burning addresses once they have been set to true. This oversight allows any address added to the allowedBurningAddresses mapping to retain permission indefinitely, potentially leading to unauthorized burning of tokens by previously authorized addresses.
https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/GameItems.sol#L185-L188
Code Review
add removeAllowedBurningAddresses function
function removeAllowedBurningAddresses(address newBurningAddress) public { require(isAdmin[msg.sender]); allowedBurningAddresses[newBurningAddress] = false; }
Context
#0 - c4-pre-sort
2024-02-22T19:33:40Z
raymondfam marked the issue as insufficient quality report
#1 - c4-pre-sort
2024-02-22T19:33:47Z
raymondfam marked the issue as duplicate of #47
#2 - c4-judge
2024-03-08T03:30:51Z
HickupHH3 marked the issue as satisfactory