AI Arena - Fitro's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/MergingPool.sol#L139-L167 https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L313-L331 https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L33 https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L495

Vulnerability details

Impact

claimRewards() allows to the winners to claim their NFT. However, if the winner owns 10 fighters, they won't be able to claim their rewards, resulting in permanent loss.

Proof of Concept

claimRewards() mint an NFT for the winners is achieved through mintFromMergingPool().

if (msg.sender == winnerAddresses[currentRound][j]) {
    _fighterFarmInstance.mintFromMergingPool(
       msg.sender,
       modelURIs[claimIndex],
       modelTypes[claimIndex],
       customAttributes[claimIndex]
     );
     claimIndex += 1;
}

Subsequently, mintFromMergingPool() invokes _createNewFighter().

function mintFromMergingPool(
    address to, 
    string calldata modelHash, 
    string calldata modelType, 
    uint256[2] calldata customAttributes
) 
    public 
{
        require(msg.sender == _mergingPoolAddress);
        _createNewFighter(
            to, 
            uint256(keccak256(abi.encode(msg.sender, fighters.length))), 
            modelHash, 
            modelType,
            0,
            0,
            customAttributes
        );
}

Within _createNewFighter(), it verifies whether the winner owns fewer than MAX_FIGHTERS_ALLOWED (which is 10); if not, reverse.

uint8 public constant MAX_FIGHTERS_ALLOWED = 10;
require(balanceOf(to) < MAX_FIGHTERS_ALLOWED);

The issue arises because winners are designated by admins for a current roundID using pickWinner(), and this designation can't be altered due to the incrementation of the roundID.

function pickWinner(uint256[] calldata winners) external {
    require(isAdmin[msg.sender]);
    require(winners.length == winnersPerPeriod, "Incorrect number of winners");
    require(!isSelectionComplete[roundId], "Winners are already selected");
    uint256 winnersLength = winners.length;
    address[] memory currentWinnerAddresses = new address[](winnersLength);
    for (uint256 i = 0; i < winnersLength; i++) {
        currentWinnerAddresses[i] = _fighterFarmInstance.ownerOf(winners[i]);
        totalPoints -= fighterPoints[winners[i]];
        fighterPoints[winners[i]] = 0;
     }
     winnerAddresses[roundId] = currentWinnerAddresses;
     isSelectionComplete[roundId] = true;
@>   roundId += 1;
}

If the winner possesses 10 fighters, they cannot claim their reward, and admins are powerless to rectify the situation because the roundID has incremented, rendering it impossible to reset the winners. Consequently, the winners lose their rewards.

Tools Used

Manual review.

Recommended Mitigation Steps

Create a function controled by admins to designate winners for a particular roundID.

Assessed type

DoS