Platform: Code4rena
Start Date: 09/02/2024
Pot Size: $60,500 USDC
Total HM: 17
Participants: 283
Period: 12 days
Judge:
Id: 328
League: ETH
Rank: 275/283
Findings: 1
Award: $0.04
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: klau5
Also found by: 0rpse, 0xBinChook, 0xDetermination, 0xGreyWolf, 0xLogos, 0xWallSecurity, 0xaghas, 0xgrbr, 0xkaju, 0xlyov, AlexCzm, BARW, Blank_Space, BoRonGod, Daniel526, DanielArmstrong, Draiakoo, FloatingPragma, Giorgio, Greed, Jorgect, Matue, McToady, MidgarAudits, Nyxaris, PUSH0, PedroZurdo, Pelz, PoeAudits, Silvermist, SpicyMeatball, Tekken, Tricko, Tumelo_Crypto, VAD37, WoolCentaur, Zac, alexzoid, andywer, aslanbek, bgsmallerbear, cats, d3e4, desaperh, dimulski, dutra, erosjohn, evmboi32, favelanky, fnanni, forkforkdog, gesha17, givn, grearlake, haxatron, honey-k12, iamandreiski, immeas, juancito, kaveyjoe, ke1caM, kiqo, klau5, korok, lil_eth, lsaudit, n0kto, ni8mare, niser93, pa6kuda, peanuts, peter, shaka, sl1, soliditywala, solmaxis69, t0x1c, tallo, thank_you, tpiliposian, visualbits, vnavascues, web3pwn, yotov721
0.0352 USDC - $0.04
https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/AiArenaHelper.sol#L83 https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L379 https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L462
The current implementation of the reRoll function in the smart contract allows users to manipulate fighter traits. This enables players to create fighters with desired traits by exploiting the deterministic nature of on-chain values used for randomness.
The reRoll function is designed to assign new attributes to a fighter NFT. It relies on on-chain values for generating randomness.A user, particularly the owner of the fighter NFT, can exploit this mechanism. By transferring the NFT between their wallets (main and alternate ones), they can influence the on-chain factors (msg.sender address) used in the randomness generation.
Manuel
Using on-chain values on randomness is not recommended. Implement Chainlink's Verifiable Random Function (VRF) to generate true randomness.
Other
#0 - c4-pre-sort
2024-02-24T02:03:43Z
raymondfam marked the issue as sufficient quality report
#1 - c4-pre-sort
2024-02-24T02:03:50Z
raymondfam marked the issue as duplicate of #53
#2 - c4-judge
2024-03-06T03:49:26Z
HickupHH3 changed the severity to 3 (High Risk)
#3 - c4-judge
2024-03-06T03:54:03Z
HickupHH3 marked the issue as satisfactory
#4 - c4-judge
2024-03-15T02:10:54Z
HickupHH3 changed the severity to 2 (Med Risk)
#5 - c4-judge
2024-03-22T04:23:09Z
HickupHH3 marked the issue as duplicate of #376