AI Arena - krikolkk's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/GameItems.sol#L291

Vulnerability details

Description

Game items added to the game have the transferable field, which indicates whether an owner of such item can transfer the given item. This is enforced in the safeTransferFrom function, where the function checks if the item can be transferred and reverts if it can not. However, this can be circumvented by using the other function of ERC-1155, safeBatchTransferFrom.

Impact

The players are able to transfer non-transferable game items.

Proof of Concept

See the following test added to test/GameItems.t.sol.

function testSafeBatchTransferNonTransferrableItem() public {
    _fundUserWith4kNeuronByTreasury(_ownerAddress);

    vm.prank(_ownerAddress);
    _gameItemsContract.mint(0, 2); //paying 2 $NRN for 2 batteries
    _gameItemsContract.adjustTransferability(0, false);
    (, , bool transferable, , , ) = _gameItemsContract.allGameItemAttributes(0);
    assertEq(transferable, false);

    // safe transfer form will revert as expected since the item is not transferable
    vm.expectRevert();
    _gameItemsContract.safeTransferFrom(_ownerAddress, msg.sender, 0, 2, "");

    uint256[] memory ids = new uint256[](1);
    ids[0] = 0;
    uint256[] memory amounts = new uint256[](1);
    amounts[0] = 2;

    // safe batch transfer from will not revert
    _gameItemsContract.safeBatchTransferFrom(
        _ownerAddress,
        msg.sender,
        ids,
        amounts,
        ""
    );

    uint ownerBalance = _gameItemsContract.balanceOf(_ownerAddress, 0);
    uint callerBalance = _gameItemsContract.balanceOf(msg.sender, 0);

    // balances have changed
    assertEq(ownerBalance, 0);
    assertEq(callerBalance, 2);
}

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding the check whether the item is transferable to either the _beforeTokenTransfer function or the safeBatchTransferFrom function.

Assessed type

Token-Transfer

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/FighterFarm.sol#L233

Vulnerability details

Impact

Anybody with a mint pass can mint the superior Dendroid type of fighter.

Proof of Concept

The owners of the mint pass can create a fighter by calling the redeemMintPass function, which will burn their mint pass NFT. However, the type of the fighter to be minted is passed as a parameter, making it possible for the owner to set it to Dendroid, which is a superior, rare type of fighter. Since there is no restriction regarding Dendroid minting, this will make every mint pass owner able to create a superior type of fighter.

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding some kind of restriction for Dendroid minting.

Assessed type

Invalid Validation

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/main/src/MergingPool.sol#L139

Vulnerability details

Impact

Users can circumvent the boundaries of fighter weight and element attributes, which might lead to undefined behavior.

Proof of Concept

A user can call the claimRewards function to claim their rewards and mint a new fighter. However, the user can specify the customAttributes, that is later passed to the mintFromMergingPool call. The value of this parameter is not validated neither in the original function nor in the mintFromMergingPool function. This means that the values can be anywhere in the range from 0 to type(uint256).max. Custom attributes are passed to createNewFighter here, where these are assigned first to local variables and then a new fighter is created with these values. However, when creating a fighter using another method accessible, the values are bounded as we can see here (the boundaries were also confirmed by the sponsor in a private conversation). Since these values are used off-chain to calculate the attributes of the fighters, we can not determine the impact of this, but the code and documentation suggest such situations should not be possible to occur and might lead to undefined behavior.

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding a check or a mechanism that will ensure that these values stay within the intended boundaries.

Assessed type

Invalid Validation