AI Arena - AgileJune's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L470 https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L370 https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L484

Vulnerability details

Impact

FighterFarm.sol::reRoll(), _createNewFighter() will be failed if generation[fighterType] > 0. It means user can't create Fighter at next generation.

Proof of Concept

numElements is set only once with constructor, and no other implementation anywhere.

reRoll(), _createNewFighter() should call _createFighterBase() inside of it. BTW, _createFighterBase() always reverts, because numElements[generation[fighterType]] is always 0 with generation[fighterType] > 0 and it's modded by zero (dna % numElements[generation[fighterType]])

    function _createFighterBase(
        uint256 dna, 
        uint8 fighterType
    ) 
        private 
        view 
        returns (uint256, uint256, uint256) 
    {
@=>     uint256 element = dna % numElements[generation[fighterType]];
        uint256 weight = dna % 31 + 65;
        uint256 newDna = fighterType == 0 ? dna : uint256(fighterType);
        return (element, weight, newDna);
    }

Tools Used

Manual Review

Recommended Mitigation Steps

needs to add setNumElements() to set numElements with generations

Assessed type

Math