Unhandled Arrng service failure

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/RandomizerRNG.sol#L42

Vulnerability details

Impact

The NextGenRandomizerRNG contract utilizes the Arrng service to generate a token hash. The calculateTokenHash function triggers requestRandomWords, which, in turn, requests a random word (a single uint256 value) from the Arrng service. The Arrng service is expected to trigger receiveRandomness, using fulfillRandomWords to set the hash. The issue arises from the fact that the arrng service might fail, and in such cases, it refunds the received payment.

This can be observed in ArrngController:
https://github.com/arrng/arrng-contracts/blob/117d2eadc55eaabb5bea58396dbc8f421d735fd5/contracts/controller/ArrngController.sol#L500-L506

Refunding NextGenRandomizerRNG:
https://github.com/arrng/arrng-contracts/blob/117d2eadc55eaabb5bea58396dbc8f421d735fd5/contracts/controller/ArrngController.sol#L582-L591

The failures happen and can be observed on https://www.arrscan.io - filter status for "fail" or "error".

Once the Arrng service fails to provide the correct value the token hash is unset and has default value of 0.

Proof of Concept

1. A user mints a new token.
2. The NextGenRandomizerRNG randomizer is used to provide a random hash value.
3. The Arrng service fails to provide the random value and refunds the cost.
4. The minted token is left with an unset token hash, equal to the value 0.

Tools Used

Manual Review

Recommended Mitigation Steps

It is recommended to add administrative functionality that will allow to trigger setting a token hash value through the Arrng service in case it failed.

Assessed type

Error

[c4-pre-sort]

141345 marked the issue as duplicate of #1464

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid