Art Gobblers contest - 8olidity's results

Lines of code

https://github.com/code-423n4/2022-09-artgobblers/blob/main/src/ArtGobblers.sol#L521-L567

Vulnerability details

Impact

If the provider stops working

Proof of Concept

RequestRandomSeed () will gobblerRevealsData. WaitingForSeed set to true

Only the provider can call acceptRandomSeed () will gobblerRevealsData. WaitingForSeed set to false

 function acceptRandomSeed(bytes32, uint256 randomness) external {
        // The caller must be the randomness provider, revert in the case it's not.
        if (msg.sender != address(randProvider)) revert NotRandProvider();

        // The unchecked cast to uint64 is equivalent to moduloing the randomness by 2**64.
        gobblerRevealsData.randomSeed = uint64(randomness); // 64 bits of randomness is plenty.

        gobblerRevealsData.waitingForSeed = false; // We have the seed now, open up reveals.

        emit RandomnessFulfilled(randomness);
    }

However, if for some reason the Provider cannot call acceptRandomSeed(). We need to update the provider. But obblerRevealsData. WaitingForSeed = = true. We can't update it. Stuck in a loop

    function upgradeRandProvider(RandProvider newRandProvider) external onlyOwner {
        // Revert if waiting for seed, so we don't interrupt requests in flight.
        if (gobblerRevealsData.waitingForSeed) revert SeedPending();

        randProvider = newRandProvider; // Update the randomness provider.

        emit RandProviderUpgraded(msg.sender, newRandProvider);
    }

Tools Used

vscode

Recommended Mitigation Steps

Add an emergency rescue function

Lines of code

https://github.com/code-423n4/2022-09-artgobblers/blob/main/src/ArtGobblers.sol#L733

Vulnerability details

Impact

Authentication can be improved

Proof of Concept

    function gobble(
        uint256 gobblerId,
        address nft,
        uint256 id,
        bool isERC1155
    ) external {
        // Get the owner of the gobbler to feed.
        address owner = getGobblerData[gobblerId].owner;

        // The caller must own the gobbler they're feeding.
        if (owner != msg.sender) revert OwnerMismatch(owner);

Tools Used

vscode

Recommended Mitigation Steps

if(owner != msg.sender || !isApprovedForAll(owner, msg.sender) || getApproved(tokenId) != msg.sender) revert OwnerMismatch(owner);