Submitted by Abdessamed, also found by juancito (1, 2), vnavascues, d3e4, DarkTower, shaka, alexxander, 0xmystery, evmboi32 (1, 2, 3), soliditywala, givn, korok, dimulski, denzi_, VAD37, sl1, OMEN, stakog, ahmedaghadi, Ryonen, FloatingPragma, n0kto (1, 2), adamn000, 0rpse, bhilare_, 0xAsen, Tendency, ke1caM, Draiakoo (1, 2), Archime, ADM, McToady, MrPotatoMagic, 0xCiphky (1, 2), VrONTg, Velislav4o, btk (1, 2), stackachu, zhaojohnson, 0xvj (1, 2), pkqs90, devblixt, niser93, cats, peter, BARW (1, 2, 3), Aamir, jesjupyter, fnanni, alexzoid, krikolkk, t0x1c, yotov721, klau5, 0xlemon, radin100, 0xAlix2, SpicyMeatball, matejdb, haxatron, JCN, immeas, PetarTolev, and Zac
The function redeemMintPass allows burning multiple mint passes in exchange for fighters NFTs. It is mentioned by the sponsor that the player should not have a choice of customizing the fighters properties and their type. However, nothing prevents a player from:
This issue has two major impacts:
For someone having valid mint passes, he calls the function redeemMintPass providing fighterTypes array of values 1. For each mint pass, the inner function _createNewFighter will be called passing the value 1 as fighterType argument which corresponds to Dendroid, a new fighter of type dendroid will be minted for the caller.
The player can also inspect previous transactions that minted a fighter with rare attributes, copy the provided mintPassDnas and provide them as argument in the redeemMintPass. The _createNewFighter function calls AiArenaHelper to create the physical attributes for the fighter. The probability of attributes is deterministic and since the player provided dna that already led to a fighter with rare attributes, his fighter will also have rare attributes.
The main issue is that the mint pass token is not tied to the fighter properties that the player should claim and the player has complete freedom of the inputs. Consider implementing a signature mechanism that prevents the player from changing the fighters properties like implemented in claimFighters
brandinho (AI Arena) confirmed
AI Arena mitigated:
Status: Mitigation confirmed. Full details in reports from niser93 and fnanni.
