# Players have complete freedom to customize the fighter NFT when calling redeemMintPass and can redeem fighters of types Dendroid and with rare attributes

redeemMintPass lets players supply arbitrary fighterTypes and dna, minting Dendroid fighters and copying rare-attribute DNA from prior txs.

- Payout: Contest reward
- Severity: high
- Program: AI Arena
- Credited: Abdessamed
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-ai-arena-findings/issues/366
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-03
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:recon technique:source-review vuln:access-control vuln:business-logic

**Target:** FighterFarm.redeemMintPass on-chain contract
**Root cause:** redeemMintPass accepts user-supplied fighterTypes and dna without binding them to the mint pass or a signature, so the player fully controls the resulting fighter's type and attributes.
**Steps:**
1. Obtain a valid mint pass via claimMintPass.
2. Approve FighterFarm to burn the mint pass.
3. Call `redeemMintPass(_mintpassIdsToBurn, _fighterTypes, _iconsTypes, _mintPassDNAs, _neuralNetHashes, _modelTypes)` with `_fighterTypes[0]=1` (Dendroid).
4. Alternatively, scan prior mint txs for dna values that produced rare attributes and pass those as `_mintPassDNAs`.
5. Fighter is minted with chosen type/attributes.
**How found:** Code reading of redeemMintPass showed fighterTypes and dna are caller-supplied and passed straight to _createNewFighter; noting AiArenaHelper attribute generation is deterministic on dna, the researcher realized dna could be copied from prior transactions.
**Exploitation:** A holder of any mint pass calls redeemMintPass with fighterType=1 to mint a Dendroid, or replays a previously observed dna string to deterministically mint a fighter with rare attributes, bypassing intended randomness and type restrictions.
**Insight:** When NFT minting takes user-supplied seed/type inputs, check whether those inputs are bound to the token or signature; deterministic attribute derivation from a caller-controlled seed lets anyone replay a known-good seed from chain history.