# Since you can reroll with a different fighterType than the NFT you own, you can reroll bypassing maxRerollsAllowed and reroll attributes based on a different fighterType

reRoll trusts caller-supplied fighterType instead of the NFT's actual type, letting owners exceed maxRerollsAllowed and reroll attributes under another type's generation.

- Payout: Contest reward
- Severity: high
- Program: AI Arena
- Credited: klau5
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-ai-arena-findings/issues/306
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** FighterFarm.reRoll (Solidity contract)
**Root cause:** reRoll takes fighterType as a parameter and never checks it matches the token's dendroidBool, so maxRerollsAllowed[fighterType] and generation[fighterType] are read from an attacker-chosen type.
**Steps:**
1. Mint a Champion (fighterType 0) NFT, tokenId 0.
2. Owner calls incrementGeneration(1) raising maxRerollsAllowed[1] above maxRerollsAllowed[0].
3. Loop reRoll(0, 0) until numRerolls[0] == maxRerollsAllowed[0].
4. Call reRoll(0, 1) — passes the check against the higher Dendroid limit and increments numRerolls[0] past the Champion cap.
5. Attributes are recomputed via _createFighterBase(dna, 1) and createPhysicalAttributes with generation[1].
**How found:** Code reading of reRoll: noticed fighterType is a free parameter while the token's real type is stored in fighters[tokenId].dendroidBool, and that maxRerollsAllowed/generation are indexed by that parameter.
**Exploitation:** Owner of any fighter repeatedly rerolls beyond their type's cap and rolls attributes using the other type's element count and generation, gaining rarer/stronger attributes at normal NRN cost.
**Escalation:** Repeated calls compound: each generation increment on the other type grants extra rerolls and shifts attribute probabilities.
**Insight:** When a function takes a type/category parameter that also indexes per-type limits or config, check it against the stored type of the referenced asset — mismatches silently borrow another category's limits and RNG parameters.