AI Arena — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for AI Arena, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 15
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 15 closed, publicly disclosed AI Arena reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against AI Arena
- Oracle manipulation findings disclosed against AI Arena
- Reentrancy findings disclosed against AI Arena
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
AI Arena: Since you can reroll with a different fighterType than the NFT you own, you can reroll bypassing maxRerollsAllowed and reroll attributes based on a different fighterType
The AI Arena FighterFarm contract contains a critical input validation vulnerability in the reRoll function. The function allows users to specify an arbitrary fighterType, which is then used to determine reroll limits and to influence the generation of new fighter attributes. By providing a fighterType different from the actual NFT type, users can bypass the intended maxRerollsAllowed constraints and manipulate their fighter's physical attributes to unintended values. This undermines the game's balance and progression mechanics.
AI Arena: Can mint NFT with the desired attributes by reverting transaction
The protocol suffered from an exploitable NFT minting mechanism where token attributes were generated deterministically during the claim transaction. Because the logic was atomic, users could deploy a malicious contract to inspect the generated attributes immediately after minting. If the attributes were unsatisfactory, the contract would revert the transaction, allowing the user to repeatedly retry the mint until obtaining their preferred, high-value attributes. This enabled unfair acquisition of rare NFTs at the cost of only gas fees.
AI Arena: Almost all rarity rank combinations cannot be, and are not uniformly, generated
The AI Arena protocol's method for generating physical attributes for NFTs suffers from a significant statistical bias, resulting in a non-uniform distribution of rarity ranks. By relying on a flawed division-based calculation to derive attributes from the DNA, the system restricts the possible combinations to a tiny fraction of the expected total, causing certain trait sets to occur twice as often as others. This failure in random attribute generation undermines the intended scarcity and rarity logic, potentially impacting the perceived and actual value of assets within the game.
AI Arena: Malicious user can stake an amount which causes zero curStakeAtRisk on a loss but equal rewardPoints to a fair user on a win
The AI Arena protocol contains a logic error in its staking mechanism that allows users to bypass penalty risks while still earning substantial rewards. By staking a negligible amount of NRN tokens, attackers exploit rounding inconsistencies in the contract's reward and penalty calculations. Specifically, the system floors the stake-at-risk penalty to zero while treating the stake as sufficient to earn a positive staking factor. This allows users to participate in the ranking system with zero downside risk, undermining the intended economic incentives of the game.
AI Arena: Erroneous probability calculation in physical attributes can lead to significant issues
The AI Arena protocol's attribute generation logic contained an off-by-one error that incorrectly distributed NFT traits. By using a greater-than-or-equal-to comparison instead of a strictly-greater-than comparison, the system skewed the expected probability of specific attributes by 1%. This vulnerability directly impacted the rarity and potential market valuation of generated game characters, as it inadvertently made certain attributes more common or entirely impossible to roll.
AI Arena: Players have complete freedom to customize the fighter NFT when calling `redeemMintPass` and can redeem fighters of types Dendroid and with rare attributes
The AI Arena protocol's NFT minting process contained a logic vulnerability that allowed users to bypass randomized character generation. By supplying specific inputs during the redemption of a mint pass, players could force the minting of specific fighter types, such as Dendroids. Furthermore, because the DNA-based attribute generation was deterministic, users could identify and replicate DNA strings that resulted in rare attributes, allowing them to mint high-value NFTs at will instead of receiving random results.
All reports in this group
- AI Arena: Burner role cannot be revokedLogic error$0
- AI Arena: Minter / Staker / Spender roles can never be revokedLogic error$0
- AI Arena: Fighter created by `mintFromMergingPool` can have arbitrary weight and elementLogic error$0
- AI Arena: DoS in `MergingPool::claimRewards` function and potential DoS in `RankedBattle::claimNRN` function if called after a significant amount of rounds passedLogic error$0
- AI Arena: Fighters cannot be minted after the initial generation due to uninitialized `numElements` mappingLogic error$0
- AI Arena: Constraints of `dailyAllowanceReplenishTime` and `allowanceRemaining` during `mint()` can be bypassed by using alias accounts & `safeTransferFrom()`Logic error$0
- AI Arena: `FighterFarm::reRoll` won't work for nft id greater than 255 due to input limited to uint8Logic error$0
- AI Arena: Player can mint more fighter NFTs during claim of rewards by leveraging reentrancy on the `claimRewards() function`Reentrancy$0
- AI Arena: Non-transferable `GameItems` can be transferred with `GameItems::safeBatchTransferFrom(...)`Logic error$0