AI Arena — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for AI Arena, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 17
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 17 closed, publicly disclosed AI Arena reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Access control, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against AI Arena
- Oracle manipulation findings disclosed against AI Arena
- Access control findings disclosed against AI Arena
- Reentrancy findings disclosed against AI Arena
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
AI Arena: NFTs can be transferred even if StakeAtRisk remains, so the user's win cannot be recorded on the chain due to underflow, and can recover past losses that can't be recovered (steal protocol's token)
AI Arena's RankedBattle integration lets a Fighter NFT become transferable as soon as its NRN stake is fully withdrawn, even when stake-at-risk tokens remain bookkept against the prior owner. Because losses decrement a per-owner, round-agnostic amountLost accumulator, a new owner who buys such an NFT and wins triggers unsigned underflow in reclaimNRN, so the victory cannot be recorded on-chain for the whole round. Conversely, because amountLost is not round-scoped and ties to the owner rather than the fighter, a buyer carrying an unrecoverable past-round loss can apply it against a purchased NFT's current stake-at-risk on a win, reclaiming value the protocol should have kept. The sponsor confirmed the issue, the judge downgraded it to Medium, and the initial mitigation—requiring getStakeAtRisk to be zero before unlocking the fighter—was later found incomplete in the follow-up review.
AI Arena: Players have complete freedom to customize the fighter NFT when calling `redeemMintPass` and can redeem fighters of types Dendroid and with rare attributes
The AI Arena protocol's NFT minting process contained a logic vulnerability that allowed users to bypass randomized character generation. By supplying specific inputs during the redemption of a mint pass, players could force the minting of specific fighter types, such as Dendroids. Furthermore, because the DNA-based attribute generation was deterministic, users could identify and replicate DNA strings that resulted in rare attributes, allowing them to mint high-value NFTs at will instead of receiving random results.
AI Arena: Almost all rarity rank combinations cannot be, and are not uniformly, generated
The AI Arena protocol's method for generating physical attributes for NFTs suffers from a significant statistical bias, resulting in a non-uniform distribution of rarity ranks. By relying on a flawed division-based calculation to derive attributes from the DNA, the system restricts the possible combinations to a tiny fraction of the expected total, causing certain trait sets to occur twice as often as others. This failure in random attribute generation undermines the intended scarcity and rarity logic, potentially impacting the perceived and actual value of assets within the game.
AI Arena: Constraints of `dailyAllowanceReplenishTime` and `allowanceRemaining` during `mint()` can be bypassed by using alias accounts & `safeTransferFrom()`
The AI Arena game items contract implements a daily minting limit to prevent users from acquiring more than 10 items in a 24-hour period. This constraint is flawed because it does not account for the transfer of items between wallets. An attacker can circumvent this limit by minting items across multiple alias accounts and consolidating them into a single primary wallet using the safeTransferFrom function. This undermines the protocol's intended item scarcity and distribution rate controls.
AI Arena: Burner role cannot be revoked
The GameItems contract contains an access control vulnerability where administrative privileges assigned to burner addresses cannot be revoked. The setAllowedBurningAddresses function is designed as an additive-only operation, permanently granting authorization to burn game items from user accounts. If an administrator mistakenly adds an unauthorized or malicious address, there is no existing functionality to remove or disable that permission, creating a permanent risk of unauthorized asset burning.
AI Arena: Malicious user can stake an amount which causes zero curStakeAtRisk on a loss but equal rewardPoints to a fair user on a win
The AI Arena protocol contains a logic error in its staking mechanism that allows users to bypass penalty risks while still earning substantial rewards. By staking a negligible amount of NRN tokens, attackers exploit rounding inconsistencies in the contract's reward and penalty calculations. Specifically, the system floors the stake-at-risk penalty to zero while treating the stake as sufficient to earn a positive staking factor. This allows users to participate in the ranking system with zero downside risk, undermining the intended economic incentives of the game.
All reports in this group
- AI Arena: Non-transferable `GameItems` can be transferred with `GameItems::safeBatchTransferFrom(...)`Logic error$0
- AI Arena: Since you can reroll with a different fighterType than the NFT you own, you can reroll bypassing maxRerollsAllowed and reroll attributes based on a different fighterTypeLogic error$0
- AI Arena: Erroneous probability calculation in physical attributes can lead to significant issuesLogic error$0
- AI Arena: DoS in `MergingPool::claimRewards` function and potential DoS in `RankedBattle::claimNRN` function if called after a significant amount of rounds passedLogic error$0
- AI Arena: `FighterFarm::reRoll` won't work for nft id greater than 255 due to input limited to uint8Logic error$0
- AI Arena: Can mint NFT with the desired attributes by reverting transactionOracle manipulation$0
- AI Arena: Fighters cannot be minted after the initial generation due to uninitialized `numElements` mappingLogic error$0
- AI Arena: A locked fighter can be transferred; leads to game server unable to commit transactions, and unstoppable fightersAccess control$0
- AI Arena: Minter / Staker / Spender roles can never be revokedLogic error$0
- AI Arena: Player can mint more fighter NFTs during claim of rewards by leveraging reentrancy on the `claimRewards() function`Reentrancy$0
- AI Arena: Fighter created by `mintFromMergingPool` can have arbitrary weight and elementLogic error$0