AI Arena - Nyxaris's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/MergingPool.sol#L139

Vulnerability details

Description

The {claimRewards](https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/MergingPool.sol#L139) function allows users to batch claim rewards for multiple rounds. It iterates over all rounds starting from the last claimed round (lowerBound) to the current round (roundId). For each round, it checks if the msg.sender is one of the winners by iterating over the winnerAddresses array for that round. If the msg.sender is a winner, they are allowed to mint a new fighter from the merging pool

The potential DoS vulnerability arises from the unbounded loop that iterates over all winners for each round. An attacker can pass through a large number of winners or rounds to process, the gas cost of executing this function could exceed block gas limits, effectively preventing users from claiming their rewards.

Impact

A user with a large number of rounds to claim could find themselves unable to claim rewards due to excessive gas costs. This could lead to frustration and a loss of trust in the system. Additionally, if the winnerAddresses array for any round is large enough, it could prevent all users from claiming rewards for that round.

Tools Used

Manual Review

Recommended Mitigation Steps

To mitigate the risk of a DoS attack, consider implementing one of the following solutions:

Limit the Number of Rounds Processed: Introduce a parameter that allows users to specify the number of rounds they wish to claim in a single transaction, thus limiting the gas cost.

Gasless Claims: Implement a gasless claiming mechanism using meta-transactions, where users sign a message off-chain and a relayer submits the transaction on-chain.

Direct Reward Distribution: Instead of requiring users to claim rewards, distribute rewards directly to the winners at the end of each round, if feasible.

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L370

Vulnerability details

Description

The reRoll function in the FighterFarm contract allows the owner of a fighter NFT to reroll its traits by paying a cost in $NRN tokens. The randomness used to generate new traits is derived from on-chain data that is predictable before the transaction is mined. This allows a user to potentially revert the transaction if the new traits are not satisfactory, avoiding the reroll cost, and try again until they receive favorable outcomes.

Impact

This issue can lead to an unfair advantage for users who have the means to perform many transactions, as they can selectively aim for the best traits without incurring the cost that other users must pay. This undermines the integrity of the game mechanics and can result in a loss of trust in the fairness of the system.

Tools Used

Manual Review

Recommendations

To mitigate this issue, it is recommended to implement one of the following solutions:

Use of Verifiable Random Function (VRF): Integrate a VRF such as Chainlink VRF to provide secure and verifiable randomness that cannot be manipulated by the user.

Non-Refundable Cost Deduction: Ensure that the reroll cost is deducted from the user's balance before any new traits are generated, and that this deduction is non-refundable, regardless of whether the transaction is reverted.

Assessed type

Other