AI Arena - kartik_giri_47538's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/FighterFarm.sol#L370

Vulnerability details

In FighterFarm::reRoll function the type of parameter tokenId is mismatched which can lead the function to revert.

Description: The FighterFarm::reRoll function in the FighterFarm contract accepts tokenId as an uint8 parameter, while in most of the protocol the tokenId is of type uint256. The mapping numRerolls which is used inside the FighterFarm::reRoll function also except the tokenId to be the type of uint256 as stated in the below code.

   /// @notice Mapping to keep track of how many times an nft has been re-rolled.
@> mapping(uint256 => uint8) public numRerolls;

Impact: The using of uint8 type for tokenId in the FighterFarm::reRoll function can lead to the potential errors which will cause the revert every time when user try to use reRoll function with the tokenId which exceeds the 255 value.

Proof of Concept: (Proof Of Code)

The below code shows how the call to reRoll function will revert if the tokenId exceeds the value 255.

contract User {
    FighterFarm fighterFarm;

    function reRollExample(uint256 tokenId) external {
        // This call will fail due to parameter type mismatch
@>      fighterFarm.reRoll(tokenId, 0);
    }
}

Recommended Mitigation: Change the tokenId parameter of FighterFarm::reRoll function to be of type uint256 to align with the most of the protocol.

Below code shows the recommended mitigation.

function reRoll(
+    uint256 tokenId,
-    uint8 tokenId,
     uint8 fighterType
     ) public {
    // Rest of Code...
}

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L156

Vulnerability details

Issue with Minting Function of Neuron contract.

Description: The Neuron::mint function in the Neuron contract checks if totalSupply() + amount < MAX_SUPPLY before minting new tokens. This condition prevents the total token supply from reaching the maximum supply defined by MAX_SUPPLY.

Impact: As a result of this condition, the token supply cannot reach the maximum supply specified by MAX_SUPPLY.

Proof of Concept: (Proof Of Code)

The below test case shows that we can not reach the MAX_SUPPLY of the token.

   function testMintWithMinterRole() public {
        address minter = vm.addr(3);
        _neuronContract.addMinter(minter);
        uint256 amount = (_neuronContract.MAX_SUPPLY() - _neuronContract.totalSupply());
        console.log("Minting amount is : ", amount);
        vm.prank(minter);
        _neuronContract.mint(minter, amount);
        assertEq(_neuronContract.balanceOf(minter), amount);
         console.log("Minting amount left: ", _neuronContract.MAX_SUPPLY() - _neuronContract.totalSupply());
    }

Output :-

[FAIL. Reason: Trying to mint more than the max supply] testMintWithMinterRole() (gas: 43989)

Recommended Mitigation: To allow the token supply to reach the maximum supply defined by MAX_SUPPLY, the condition in the mint function should be modified to totalSupply() + amount <= MAX_SUPPLY. This change ensures that the maximum supply can be reached without exceeding it.

Below code shows the recommended mitigation.

function mint(address to, uint256 amount) public virtual {
-   require(totalSupply() + amount < MAX_SUPPLY, "Trying to mint more than the max supply");
+   require(totalSupply() + amount <= MAX_SUPPLY, "Trying to mint more than or equal to the max supply");
    // Minting logic...
}

Assessed type

ERC20