AI Arena

Gaming + NFT|2,000 LOC|8H + 9M = 17 findings|Repo

Tool Results

Official Findings (17)

H-01Locked fighter can be transferred; leads to game server issues

H-02Non-transferable GameItems can be transferred with safeBatchTransferFrom

H-03Players can customize fighter NFT when calling redeemMintPass

H-04Can reroll with different fighterType, bypassing maxRerollsAllowed

H-05Malicious user can stake amount causing zero curStakeAtRisk on loss

H-06FighterFarm reroll won't work for nft id > 255 due to uint8 input

H-07Fighters cannot be minted after initial generation due to uninitialized numElements

H-08Player can mint more fighter NFTs by reentrancy on claimRewards()

M-01Almost all rarity rank combinations cannot be generated

M-02Minter/Staker/Spender roles can never be revoked

M-03Fighter from mintFromMergingPool can have arbitrary weight/element

M-04DoS in MergingPool::claimRewards and RankedBattle::claimNRN

M-05Can mint NFT with desired attributes by reverting transaction

M-06NFTs can be transferred even if StakeAtRisk remains

M-07Erroneous probability calculation in physical attributes

M-08Burner role can not be revoked

M-09Constraints of dailyAllowance can be bypassed via alias accounts