AI Arena - maxim371's results

In AI Arena you train an AI character to battle in a platform fighting game. Imagine a cross between Pokémon and Super Smash Bros, but the characters are AIs, and you can train them to learn almost any skill in preparation for battle.

General Information

Platform: Code4rena

Start Date: 09/02/2024

Pot Size: $60,500 USDC

Total HM: 17

Participants: 283

Period: 12 days

Judge:

Id: 328

League: ETH

AI Arena

Findings Distribution

Researcher Performance

Rank: 67/283

Findings: 1

Award: $111.68

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

111.676 USDC - $111.68

Labels

bug
3 (High Risk)
satisfactory
sufficient quality report
:robot:_49_group
duplicate-68

External Links

Lines of code

https://github.com/code-423n4/2024-02-ai-arena/blob/f2952187a8afc44ee6adc28769657717b498b7d4/src/FighterFarm.sol#L370

Vulnerability details

Impact

Using uint8 instead of uint256 in Solidity has implications regarding storage efficiency, range of values, and potential for overflow. This means only the first 256 tokenIDs can reroll which is not the intended logic

Proof of Concept

https://github.com/code-423n4/2024-02-ai-arena/blob/f2952187a8afc44ee6adc28769657717b498b7d4/src/FighterFarm.sol#L370

https://github.com/code-423n4/2024-02-ai-arena/blob/f2952187a8afc44ee6adc28769657717b498b7d4/src/FighterFarm.sol#L370-L391

Tools Used

Manual Review

change from uint8 to uint256 for tokenIDs

Assessed type

Error

#0 - c4-pre-sort

2024-02-22T02:21:49Z

raymondfam marked the issue as sufficient quality report

#1 - c4-pre-sort

2024-02-22T02:21:55Z

raymondfam marked the issue as duplicate of #68

#2 - c4-judge

2024-03-05T02:00:08Z

HickupHH3 marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter