Moonscape - Seascape

None

Code Location

contracts/defi/MoonscapeDefi.sol

    function stakeToken(uint _stakeId, uint _cityId, uint _buildingId, uint _amount, uint8 v, bytes32[2] calldata sig) external {
        TokenStaking storage tokenStaking = tokenStakings[_stakeId];

        // todo
        // validate the session id
        bytes32 stakeKey = stakeKeyOf(tokenStaking.sessionId, _stakeId);

        require(isActive(stakeKey), "session not active");

        //validate stake id
        require(_stakeId <= stakeId,"do not have this stakeId");

        {
        bytes memory prefix     = "\x19Ethereum Signed Message:\n32";
        bytes32 message         = keccak256(abi.encodePacked(_stakeId, tokenStaking.sessionId, _cityId, _buildingId));
        bytes32 hash            = keccak256(abi.encodePacked(prefix, message));
        address recover         = ecrecover(hash, v, sig[0], sig[1]);

        require(recover == owner(), "Verification failed about stakeToken");
        }

        deposit(stakeKey, msg.sender, _amount);

        IERC20 token = IERC20(tokenStaking.stakeToken);

        require(token.balanceOf(msg.sender) >= _amount, "Not enough token to stake");
        // uint preBalance = token.balanceOf(address(this));

        token.safeTransferFrom(msg.sender, address(this), _amount);
        // _amount = token.balanceOf(address(this)) - preBalance;
        emit StakeToken(msg.sender, tokenStaking.sessionId, _stakeId, _cityId, _buildingId, _amount);
    }

contracts/defi/MoonscapeDefi.sol

    function stakeNft(uint _stakeId, uint _cityId, uint _buildingId, uint _scapeNftId, uint _power, uint8 _v, bytes32[2] calldata sig) external {
        TokenStaking storage tokenStaking = tokenStakings[_stakeId];

        // validate the session id
        bytes32 stakeKey = stakeKeyOf(tokenStaking.sessionId, _stakeId);

        Player storage player = playerParams[stakeKey][msg.sender];

        require(player.nftId <= 0 && player.power <= 0, "already stake nft");

        require(isActive(stakeKey), "session not active");

        //validate stake id
        require(_stakeId <= stakeId,"do not have this stakeId");

        IERC721 nft = IERC721(tokenStaking.stakeToken);
        require(nft.ownerOf(_scapeNftId) == msg.sender, "not owned");

        {
        bytes memory prefix     = "\x19Ethereum Signed Message:\n32";
        bytes32 message         = keccak256(abi.encodePacked(tokenStaking.sessionId, _stakeId, _cityId, _buildingId, _scapeNftId, _power));
        bytes32 hash            = keccak256(abi.encodePacked(prefix, message));
        address recover         = ecrecover(hash, _v, sig[0], sig[1]);

        require(recover == owner(), "Verification failed about stakeNft");
        }

        nft.safeTransferFrom(msg.sender, address(this), _scapeNftId);

        deposit(stakeKey, msg.sender, _power);

        player.nftId = _scapeNftId;
        player.power = _power;

        emit StakeNft(msg.sender, tokenStaking.sessionId, _stakeId, _cityId, _buildingId, _scapeNftId, _power);
    }

contracts/defi/MoonscapeDefi.sol

    function getBonus(uint _stakeId, uint _cityId, uint _buildingId, uint _bonusPercent, uint8 _v, bytes32[2] calldata sig) external {
        TokenStaking storage tokenStaking = tokenStakings[_stakeId];
        Session storage session = sessions[tokenStaking.sessionId];
        bytes32 stakeKey = stakeKeyOf(tokenStaking.sessionId, _stakeId);

        require(block.timestamp > session.endTime, "it has to be after the session");

        Player storage player = playerParams[stakeKey][msg.sender];

        require(player.receiveBonus == true, "already rewarded");

        {
        bytes memory prefix     = "\x19Ethereum Signed Message:\n32";
        bytes32 message         = keccak256(abi.encodePacked(_stakeId, tokenStaking.sessionId, _cityId, _buildingId, _bonusPercent));
        bytes32 hash            = keccak256(abi.encodePacked(prefix, message));
        address recover         = ecrecover(hash, _v, sig[0], sig[1]);

        require(recover == owner(), "Verification failed about getBonus");
        }

        uint256 _totalreward = claimable(stakeKey, msg.sender) + player.claimedAmound;
        uint256 _totalBonus  = _totalreward.mul(scaler).mul(_bonusPercent).div(100).div(scaler);

        require(_totalBonus > 0, "totalBonus must > 0");
        _safeTransfer(tokenStaking.rewardToken, msg.sender, _totalBonus);

        player.receiveBonus = true;
    }

SOLVED: Code is not checking for msg.sender in signatures.

None

Code Location

contracts/defi/MoonscapeDefi.sol

    function startSession(uint _startTime, uint _endTime) external {
        require(validSessionTime(_startTime, _endTime), "INVALID_SESSION_TIME");

        sessionId++;

        sessions[sessionId] = Session(_startTime, _endTime, true);

        emit StartSession(sessionId, _startTime, _endTime);
    }

contracts/defi/MoonscapeDefi.sol

    function validSessionTime(uint _startTime, uint _endTime) public view returns(bool) {
        Session storage session = sessions[sessionId];

        if (_startTime > session.endTime && _startTime >= block.timestamp && _startTime < _endTime) {
            return true;
        }

        return false;
    }

RISK ACCEPTED: The code is protected with the onlyOwner modifier, so only the owner can add new sessions. Plus, the client states that: "This is done on purpose because if we by any chance make a mistake, we would need to redeploy everything. But with multiple active sessions, we can just open another session and change the active session in the client"

None

Code Location

game/MoonscapeGame.sol

    constructor(
        address _mscpToken,
        address _cityNft,
        address _roverNft,
        address _scapeNft,
        address _verifier,
        address _feeTo
    ) public {
        MSCP = _mscpToken;
        cityNft = _cityNft;
        roverNft = _roverNft;
        scapeNft = _scapeNft;
        verifier = _verifier;
        feeTo = _feeTo;
    }

SOLVED: The code is now checking if the parameters are not zero.

None

Code Location

nfts/CityNft.sol

    function mint(uint _tokenId, uint8 _category, address _to) external returns(bool) {
        if (!minters[msg.sender] || minted[_tokenId] || _to == address(0) || _category > 8) {
            return false;
        }

          categoryOf[_tokenId] = _category;

        _safeMint(_to, _tokenId);

          emit Minted(_to, _tokenId, _category, block.timestamp);
          return true;
    }

nfts/RoverNft.sol

    function mint(uint _tokenId, uint8 _type, address _to) external returns(bool) {
        if (!minters[msg.sender] || minted[_tokenId] || _to == address(0) || _type > 8) {
            return false;
        }

          typeOf[_tokenId] = _type;

        _safeMint(_to, _tokenId);

          emit Minted(_to, _tokenId, _type, block.timestamp);
          return true;
    }

SOLVED: Variables were removed from the parameters and the contract storage.

None

Code Location

contracts/defi/MoonscapeDefi.sol

function addTokenStaking(uint _sessionId, address stakeAddress, uint rewardPool, address rewardToken, uint _burn) external {
        bytes32 key = keccak256(abi.encodePacked(_sessionId, stakeAddress, rewardToken));

        require(!addedStakings[key], "DUPLICATE_STAKING");

        addedStakings[key] = true;
        bool burn = true;

        if (_burn == 1) {
            burn = true;
        } else {
            burn = false;
        }

        tokenStakings[++stakeId] = TokenStaking(_sessionId, stakeAddress, rewardPool, rewardToken, burn);

        bytes32 stakeKey = stakeKeyOf(sessionId, stakeId);

        keyToId[stakeKey] = stakeId;

        Session storage session = sessions[_sessionId];

        newStakePeriod(
            stakeKey,
            session.startTime,
            session.endTime,
            rewardPool    
        );

        emit AddStaking(_sessionId, stakeId);
    }

contracts/defi/MoonscapeDefi.sol

function validSessionTime(uint _startTime, uint _endTime) public view returns(bool) {
        Session storage session = sessions[sessionId];

        if (_startTime > session.endTime && _startTime >= block.timestamp && _startTime < _endTime) {
            return true;
        }

        return false;
    }

SOLVED: The memory keyword is now used instead of storage.

None

Code Location

game/MoonscapeGame.sol

    function mintRover(uint _id, uint8 _type, uint  _amount, uint8 _v, bytes32 _r, bytes32 _s) external {
       {   // avoid stack too deep
       // investor, project verification
    bytes memory prefix     = "\x19Ethereum Signed Message:\n32";
    bytes32 message         = keccak256(abi.encodePacked(msg.sender, address(this), roverNft, _id, _amount, _type));
    bytes32 hash            = keccak256(abi.encodePacked(prefix, message));
    address recover         = ecrecover(hash, _v, _r, _s);

    require(recover == verifier, "sig");
       }

       CityNft nft = CityNft(roverNft);
       require(nft.mint(_id, _type, msg.sender), "Failed to mint rover");

       emit MintRover(msg.sender, _amount, _id, _type);
   }

game/MoonscapeGame.sol

    function mintCity(uint _id, uint8 _category, uint _amount, uint8 _v, bytes32 _r, bytes32 _s) external {
       {   // avoid stack too deep
       // investor, project verification
    bytes memory prefix     = "\x19Ethereum Signed Message:\n32";
    bytes32 message         = keccak256(abi.encodePacked(msg.sender, address(this), cityNft, _id, _amount, _category));
    bytes32 hash            = keccak256(abi.encodePacked(prefix, message));
    address recover         = ecrecover(hash, _v, _r, _s);

    require(recover == verifier, "sig");
       }

       CityNft nft = CityNft(cityNft);
       require(nft.mint(_id, _category, msg.sender), "Failed to mint city");

       emit MintCity(msg.sender, _amount, _id, _category);
   }

SOLVED: Removed _amount variable from function arguments.