AI Arena - kutugu's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/GameItems.sol#L301

Vulnerability details

Impact

safeBatchTransferFrom is not restricted by transferable variable

Proof of Concept

    function testBypassTransferability() public {
        _fundUserWith4kNeuronByTreasury(_ownerAddress);
        _gameItemsContract.mint(0, 2); //paying 2 $NRN for 2 batteries
        _gameItemsContract.adjustTransferability(0, false);
        (,, bool transferable,,,) = _gameItemsContract.allGameItemAttributes(0);
        assertEq(transferable, false);

        // @audit safeTransferFrom can prevent
        vm.expectRevert();
        _gameItemsContract.safeTransferFrom(address(this), address(0xdead), 0, 2, "");
        // @audit safeBatchTransferFrom can NOT prevent
        uint256[] memory ids = new uint256[](1);
        ids[0] = 0;
        uint256[] memory values = new uint256[](1);
        values[0] = 2;
        _gameItemsContract.safeBatchTransferFrom(address(this), address(0xdead), ids, values, "");
    }

Tools Used

Foundry

Recommended Mitigation Steps

safeBatchTransferFrom should also be overridden

Assessed type

Context

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/cd1a0e6d1b40168657d1aaee8223dc050e15f8cc/src/Neuron.sol#L93-L112

Vulnerability details

Impact

Neuron cannot remove privileged role. If some roles do evil or have their private keys leaked. They will arbitrarily mint and consume tokens, seriously damaging the economic system.

Proof of Concept

    function addMinter(address newMinterAddress) external {
        require(msg.sender == _ownerAddress);
        _setupRole(MINTER_ROLE, newMinterAddress);
    }

    function addStaker(address newStakerAddress) external {
        require(msg.sender == _ownerAddress);
        _setupRole(STAKER_ROLE, newStakerAddress);
    }

    function addSpender(address newSpenderAddress) external {
        require(msg.sender == _ownerAddress);
        _setupRole(SPENDER_ROLE, newSpenderAddress);
    }

Neuron only exposes the interface for adding privileged roles, but does not expose the interface for removing privileged roles. If some privileged roles do evil or their private keys are leaked, these roles cannot be removed.

Tools Used

Manual review

Recommended Mitigation Steps

Set DEFAULT_ADMIN_ROLE or add interfaces to remove privileged roles

Assessed type

Access Control