AI Arena - 0xlamide's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L462-L474

Vulnerability details

Impact

Once the generation of a specific fighter type is increased,new fighter cannot be created for such fighter type

Proof of Concept

This issue occurs because numElement state for newly created generation is not updated https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L85 when the generation of a specific fighter type is incremented https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L129-L134 . This cause the numElement of the incremented generation to 0 by default, thereby causing _createFighterBase https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L462-L474 to always revert at this point https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L470 for such when creating a new fighter

Tools Used

Manual review

Recommended Mitigation Steps

numElement[] of generation of fighter type should be updated when increment generation in the incrementGeneratiion()

Assessed type

Context