detectiveking - Frontrunning with startNewRound() about 2023-10-looksrare-judging

[0xhiroshi]

There are 50 blocks per round, agents have 49 blocks to heal/escape without being frontrun. Even if startNewRound is only callable by the owner it might still make some heal/escape calls revert they are done in the same block.

[nevillehuang]

There are 50 blocks per round, agents have 49 blocks to heal/escape without being frontrun. Even if startNewRound is only callable by the owner it might still make some heal/escape calls revert they are done in the same block.

Hi @0xhiroshi, this issue is not mentioned as an accepted risk in the contest details. Since it can result in unfair game mechanics for subsequent rounds, inclined to keep it as medium

[0xhiroshi]

@nevillehuang The parameters are in the deployment script as well as in the test, it's part of the repository that's copied over the contest.

[nevillehuang]

@nevillehuang The parameters are in the deployment script as well as in the test, it's part of the repository that's copied over the contest.

Thanks for the response! Could you point me to specific LOC in the tests that could imply that this issue is intended behavior? I am assuming you refer to this test

[0xhiroshi]

I fail to see how this is a real issue. This is as fair as it gets, players get plenty of time to do it and this is not a risk that we have to accept to begin with.

[0xhiroshi]

https://github.com/sherlock-audit/2023-10-looksrare/blob/main/contracts-infiltration/test/foundry/TestParameters.sol#L8

https://github.com/sherlock-audit/2023-10-looksrare/blob/main/contracts-infiltration/scripts/deployment/Deployment.s.sol#L59

[nevillehuang]

Agree with sponsor. If users choose to escape()/heal() extremely close to the end of the round, they should bear the risk of those functions reverting given this is a game. Even if you restrict the function, there is no guarantee that some users would still heal or escape.

Additionally, the startNewRound() function should remain public, as there is no reason that it should be called only by the owner to ensure the game is fair and won't be delayed. As such, this function should be called by any participant/anyone as soon as it is available to keep the game going.