AI Arena - adam-idarrha's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L355-L365 https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L338-L348

Vulnerability details

Vulnerability details:

Details:

The contract FighterFarm manages fighter NFTs, imposing restrictions on their transfer via the _ableToTransfer function, which is called within overridden transfer functions. These functions check that the destination address doesn't possess more than 10 NFTs and that the fighter is not staked. However, the function safeTransferFrom(from, to , tokenId, data) lacks this override and check implementation, enabling a bypass of these restrictions.

Impact:

This vulnerability allows a user to hold more than 10 fighters simultaneously and transfer a staked fighter, violating key system invariants.

Proof of Concept:

• consider that Alice has 1 Fighter with tokenId = 15 which she staked with in rankedBattle contract.
• and Bob has 10 fighters
• Alice calls the function safeTransferFrom(Alice, Bob , 15, "")
• the function _ableToTransfer is not called, so there is no check and Bob ends with 11 fighters , and a fighter that is currently at stake .

Tools Used:

vscode

Recommended Mitigation Steps:

override the function safeTransferFrom(from, to , tokenId, data) in the same way you do for the other functions.

Assessed type

ERC721