Submitted by klau5, also found by McToady, Tychai0s (1, 2), vnavascues, d3e4, shaka, alexxander, grearlake, AlexCzm, lanrebayode77, evmboi32, givn, juancito, VAD37, Varun_05, DanielArmstrong, linmiaomiao, 14si2o_Flint, Ryonen, n0kto, alexzoid, ktg, denzi_, Aymen0909, Davide, soliditywala, Aamir, sashik_eth, sl1, nuthan2x, 0xAsen, merlinboii, ke1caM, Draiakoo, petro_1912, MrPotatoMagic, PoeAudits, 0xCiphky, aslanbek, 0xvj, cats (1, 2), yotov721, btk, pynschon, solmaxis69, fnanni, 0xAlix2, 0xKowalski, blutorque, t0x1c, ubl4nk, BARW, radin100, Giorgio, zhaojohnson, 0xlemon, jesjupyter, SpicyMeatball, novamanbg, xchen1130, matejdb, haxatron, 0xAleko, Blank_Space, and Silvermist
Can reroll attributes based on a different fighterType, and can bypass maxRerollsAllowed.
maxRerollsAllowed can be set differently depending on the fighterType. Precisely, it increases as the generation of fighterType increases.
The reRoll function does not verify if the fighterType given as a parameter is actually the fighterType of the given tokenId. Therefore, it can use either 0 or 1 regardless of the actual type of the NFT.
This allows bypassing maxRerollsAllowed for additional reRoll, and to call _createFighterBase and createPhysicalAttributes based on a different fighterType than the actual NFTs fighterType, resulting in attributes calculated based on different criteria.
PoC:
Check fighterType at reRoll function.
raymondfam (lookout) commented:
brandinho (AI Arena) confirmed
hickuphh3 (judge) increased severity to High and commented:
AI Arena mitigated:
Status: Mitigation confirmed. Full details in reports from niser93, d3e4, and fnanni.
