AI Arena - Sabit's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L90-L96

Vulnerability details

Impact

Added minter addresses are permanent and cannot be revoked.

Proof of Concept

The addMinter function allows new minter addresses to be added, but there is no corresponding function to remove minter addresses. This is a bug because minter addresses cannot be revoked.

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L90-L96

Tools Used

Manual review

Recommended Mitigation Steps

Add a function that allows owner to remove minter addresses.

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L101-L104

Vulnerability details

Impact

Detailed description of the impact of this finding.

Proof of Concept

The addStaker function allows new staker addresses to be added.

However, there is no function to remove or revoke a staker address. Once an address is added as a staker, it will remain a valid staker indefinitely.

This is a bug because it means there is no way to remove a staker's privileges if their address is compromised or needs to be revoked for any other reason.

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L101-L104

Tools Used

Manual review

Recommended Mitigation Steps

Add a function that can revoke added staker addresses.

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L109-L112

Vulnerability details

Impact

Detailed description of the impact of this finding.

Proof of Concept

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L109-L112

The addSpender function adds a new address to the spender role.

This gives newSpenderAddress the ability to spend tokens from the contract.

However, there is no corresponding function to revoke or remove a spender address. Once an address is granted spender privileges, those privileges remain indefinitely.

This is a bug because compromised or unauthorized spender addresses cannot have their privileges revoked. The contract should have a revokeSpender function to remove spenders when necessary.

Tools Used

Manual review

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/GameItems.sol#L185-L189

Vulnerability details

Impact

Allowed burning addresses cannot be removed

Proof of Concept

The setAllowedBurningAddresses function is intended to allow the admin to set and update which addresses are allowed to burn tokens. However, there is a logical flaw in the function implementation that prevents removing addresses from the allow list once added.

Specifically, the function only includes logic to add new addresses to the allowedBurningAddresses mapping, by setting their mapping value to true. There is no functionality to later set their value back to false to remove access.

This means any address that is ever set as an allowed burning address can never have that permission revoked, even by the admin. This violates the expected functionality and gives permanent privileged access.

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/GameItems.sol#L185-L189

Tools Used

Manual review

Recommended Mitigation Steps

Include how to remove an added address from the mapping.

Assessed type

Context