AI Arena - AC000123's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/RankedBattle.sol#L530-L532

Vulnerability details

Impact

In _getStakingFactor, when stakedAmount < 1 NRN, stakingFactor_ will always be 1. This allows a player to make positive points without any risk of loss by depositing minimal amount of $NRN(< 10**4 / bpsLostPerLoss wei)

Proof of Concept

If player deposits 1 wei and participate in a match, curStakeAtRisk will be always zero and therefore even if player lost the match, no staked fund will be at rist of loss. When player win the match, stakeAtRisk always be zero and points should be the same with eloFactor In the game economics, Penalty for Losing is one of the most important mechanism which can be destoryed by this issue.

Tools Used

Manual Review

Recommended Mitigation Steps

We can make an minimum limit of staking.

Assessed type

Other