Submitted by AvantGard, also found by Tigerfrake, gajiknownnothing, zhaojohnson, robertodf99, Abdessamed, _karanel, 0x3b, p0wd3r, ZanyBonzy, almurhasan, Agontuk, oxwhite, samuraii77, D_Auditor, MinhTriet, peanuts, stanchev, Tamer, 0xb0k0, air_0x, anonymousjoe, Autosaida, MrValioBg, pfapostol, shikhar229169, hakunamatata, LeFy, dontonka, shui, VulnViper, jesjupyter, sl1, rndquu, Coinymous, cryptomoon, 0xvd, 0xlemon, onthehunt11, 0xPwned, Xcrypt, dyoff, nervouspika, perseus, Nihavent, LonelyWolfDemon, den-sosnowsky, Udsen, inzinko, dhank, hail_the_lord, turvy_fuzz, rbserver, yotov721, KupiaSec, al88nsk, Ryonen, klau5, nnez, ke1caM, shaflow2, shaka, ZdravkoHr, Beosin, and dimulski
https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/EntityForging/EntityForging.sol#L87-L90
https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/EntityForging/EntityForging.sol#L133
As per the docs:
This means an entity with forgePotential of 0 is infertile, an entity with forgePotential = 1 can forge 1 time an year, an entity with forgePotential = 2 can forge 2 times an year and so on.
The number of times an entity forges is tracked in the forgingCounts mapping. This mapping is incremented for both the forgerTokenId and mergerTokenId everytime a successful forging happens thru forgeWithListed.
The forgingCounts[] of mergerTokenIds is handled correctly. The increment of forgingCounts[] precedes the condition check:
However, Forger Entities forgerTokenId are able to exceed the forging limit
due to increment of forgingCounts[] happening after the condition check. The check is made during the listForForging call, but the forgingCounts[] mapping is only incremented during forgeWithListed call. This allows the Forger Entities to list one more time than intended.
This results in each Forger entity with non-zero forgingPotential having the ability to forge 2-10 times, instead of 1-9 times intended by the protocol.
As long as Forger Entities have a non-zero forgingPotential, the Entity is able to exceed the limit intended by forgingPotential.
Assume a Forger Entity of:
First Listing:
Second Listing:
Third Listing: (Reverts only at the third attempt)
This shows a Forger Entity with a forgingPotential of 1 can forge 2 times. Similarly, a forger entity with forgingPotential of 9 can forge 10 times.
Foundry
This can be fixed in different ways. The simplest way is to use the < instead of the <= in the listForForging condition check.
forgingCounts[tokenId] < forgePotential
Invalid Validation
TForge1 (TraitForge) confirmed
