AI Arena - cu5t0mpeo's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/MergingPool.sol#L139-L167

Vulnerability details

Impact

Users may not be able to claim rewards

Proof of Concept

When a user becomes a winner in a certain round, he can call claimRewards to claim the rewarded fighter.

    function claimRewards(
        string[] calldata modelURIs, 
        string[] calldata modelTypes,
        uint256[2][] calldata customAttributes
    ) 
        external 
    {
        uint256 winnersLength;
        uint32 claimIndex = 0;
        uint32 lowerBound = numRoundsClaimed[msg.sender];
        for (uint32 currentRound = lowerBound; currentRound < roundId; currentRound++) {
            numRoundsClaimed[msg.sender] += 1;
            winnersLength = winnerAddresses[currentRound].length;
            for (uint32 j = 0; j < winnersLength; j++) {
                if (msg.sender == winnerAddresses[currentRound][j]) {
                    _fighterFarmInstance.mintFromMergingPool(
                        msg.sender,
                        modelURIs[claimIndex],
                        modelTypes[claimIndex],
                        customAttributes[claimIndex]
                    );
                    claimIndex += 1;
                }
            }
        }
        if (claimIndex > 0) {
            emit Claimed(msg.sender, claimIndex);
        }
    }

However, if the user does not receive the reward fighter for a long time, the user will lose all his reward fighters. Because when claiming rewards, calling mintFromMergingPool->_createNewFighter will check whether the number of fighters owned by the user is greater than 10.

    uint8 public constant MAX_FIGHTERS_ALLOWED = 10;
    ...
    function _createNewFighter(
        address to, 
        uint256 dna, 
        string memory modelHash,
        string memory modelType, 
        uint8 fighterType,
        uint8 iconsType,
        uint256[2] memory customAttributes
    ) 
        private 
    {  
        require(balanceOf(to) < MAX_FIGHTERS_ALLOWED);
        ...
    }

If it is greater than 10 the entire transaction will be reverted. As a result, users will not be able to receive reward fighter.

Since the user will lose all rewards, the level is high

Tools Used

Manual Review

Recommended Mitigation Steps

Users should be allowed to set the number to receive, rather than receiving all fighters at once.

Assessed type

DoS