AI Arena - adamn000's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L254

Vulnerability details

Impact

Users will be eligble to mint new NFT's by FighterFarm::redeemMintPass, one of the parameters in this function is mintPassDnas. Then, this function calls FighterFarm::_createNewFighter function, with mintPassDnas as a hashed uint256. In FighterFarm::_createNewFighter function, to get NFT attributes as element, weight and newDna, protocol using FighterFarm::_createFighterBase function with dna parameter which is uint256 hashed mintPassDnas. Reference to documentation, "A fighter’s weight is the primary determinant of its other relative strength and weaknesses (i.e. all other battle attributes are a function of weight)". As we can see in FighterFarm::_createNewFighter function, weight is based on dna.

There are similiar situation in FighterFarm::claimFighters, FighterFarm::mintFromMergingPool and FighterFarm::reRoll. In this case it is harder to get the best weight beacuse dna depends on user address and other variables. Furthermore, user can check what parameters will give better weight and mint when condition are met.

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L214

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L324

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L379

Proof of Concept

User interact with FighterFarm::redeemMintPass function and mintPassDnas = "1234". Following next steps, uint256(keccak256(abi.encode(mintPassDnas)) = 109354925330486725663316016813838071664739777272443667231673145530778523508943, this number is the dna. Finally, weight = dna % 31 + 65. In this example, weight is equal 94, weight range is 65-95 (there are 3 types of weights: 65-74, 75-84, 85-94). In this case user will get the best fighter NFT.

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L254

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L500

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L471

Tools Used

Manual review.

Recommended Mitigation Steps

Use Chainlink VRF to get random number and be sure weight and other parameters is random. (https://docs.chain.link/vrf)

Assessed type

ERC721