Art Gobblers contest - imare's results

Lines of code

https://github.com/code-423n4/2022-09-artgobblers/blob/d2087c5a8a6a4f1b9784520e7fe75afa3a9cbdbe/src/ArtGobblers.sol#L562

Vulnerability details

The protocol is relaying on random seed passed to us from a random provider to provide reveling functionality of newly minted gobblers.

If such provider doesn't work anymore... maliciously or not ...the protocol cannot revel new gobblers and also upgrading such provider doesn't work anymore.

Effectively it breaks the protocol.

Impact

A working random provider after we request a seed (calling requestRandomSeed) will call us back with our new seed in the function acceptRandomSeed. This function can only be called by our designated random provider.

If we don't get called in this function then watingForSeed variable stays always on true.

If this happen we can no longer reveal any new gobblers because we get always reverted with SeedPending exception.

If we try to upgrade the random provider we get the same exception as above because this if check:

https://github.com/code-423n4/2022-09-artgobblers/blob/d2087c5a8a6a4f1b9784520e7fe75afa3a9cbdbe/src/ArtGobblers.sol#L562

if (gobblerRevealsData.waitingForSeed) revert SeedPending();

Recommended Mitigation Steps

In the upgrade function upgradeRandProvider add a bool paramter to bypass the if that checks for the waiting seed.

Or just remove the problematic if altogether and just proceed with changing the address of the random provider directly.