AI Arena - 0xprinc's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/GameItems.sol#L289-L303 https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC1155/ERC1155.sol#L120-L132

Vulnerability details

Impact

Game Items that are not transferable can be transfered.

Proof of Concept

The function safeTransferFrom() in GameItems.sol includes a validation check:

require(allGameItemAttributes[tokenId].transferable);

This check is designed to prevent the transfer of items marked as non-transferable. However, there exists another method for transferring items, safeBatchTransferFrom(), found in ERC1155.sol, which GameItems.sol inherits. Since GameItems.sol does not override safeBatchTransferFrom(), it inadvertently allows for the transfer of items regardless of their transferable status.

Tools Used

Manual Review

Recommended Mitigation Steps

To address this issue, it is recommended to override the safeBatchTransferFrom() function in GameItems.sol to include the same transferability check:

require(allGameItemAttributes[tokenId].transferable);

Assessed type

Token-Transfer