AI Arena - Cryptor's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/MergingPool.sol#L134-L167

Vulnerability details

Impact

Claiming Rewards can consume too much gas and revert unexpectedly

Proof of Concept

The function claim rewards allows a user to batch claim rewards for multiple rounds

    function claimRewards(
        string[] calldata modelURIs, 
        string[] calldata modelTypes,
        uint256[2][] calldata customAttributes
    ) 
        external 
    {
        uint256 winnersLength;
        uint32 claimIndex = 0;
        uint32 lowerBound = numRoundsClaimed[msg.sender];
        for (uint32 currentRound = lowerBound; currentRound < roundId; currentRound++) {
            numRoundsClaimed[msg.sender] += 1;
            winnersLength = winnerAddresses[currentRound].length;
            for (uint32 j = 0; j < winnersLength; j++) {
                if (msg.sender == winnerAddresses[currentRound][j]) {
                    _fighterFarmInstance.mintFromMergingPool(
                        msg.sender,
                        modelURIs[claimIndex],
                        modelTypes[claimIndex],
                        customAttributes[claimIndex]
                    );
                    claimIndex += 1;
                }
            }
        }
        if (claimIndex > 0) {
            emit Claimed(msg.sender, claimIndex);
        }
    }

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/MergingPool.sol#L139-L143

However, upon closer examination, there are several nested for loops. If the function has not claimed rewards for several rounds, then the function could end up consuming a lot of gas that could reach the gas limit. This is in part because the amount of rounds that has passed and the length of the winners, are unbounded, meaning that the gas consumption will scale depending on the length of these variables.

In addition, the potential for up to 10 fighters to be minted per user exacerbates the problem, making the cost of this transaction more expensive over time.

Tools Used

Manual Review

Recommended Mitigation Steps

Rewrite the function so that it consumes less gas

Assessed type

DoS