# Malicious user can stake an amount which causes zero curStakeAtRisk on a loss but equal rewardPoints to a fair user on a win

Staking 1 wei NRN rounds stakingFactor up to 1, giving full reward points on a win while curStakeAtRisk rounds to zero on a loss.

- Payout: Contest reward
- Severity: high
- Program: AI Arena
- Credited: t0x1c
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-ai-arena-findings/issues/116
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-05
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** RankedBattle.sol staking/reward accounting (_getStakingFactor, _addResultPoints)
**Root cause:** _getStakingFactor rounds stakingFactor_ up to 1 when zero, while curStakeAtRisk is rounded down, so a 1-wei stake yields stakingFactor 1 (same reward points as ~4e18-1 wei) but zero stake at risk on a loss.
**Steps:**
1. Deploy test in test/RankedBattle.t.sol, mint fighter and fund player with NRN.
2. Call `stakeNRN(1, 0)` (1 wei) as player.
3. Game server calls `updateBattleRecord(0, 50, 0, 1500, true)` for a win: accumulatedPointsPerFighter = 750, same as staking 4e18-1 wei.
4. Game server calls `updateBattleRecord(0, 50, 2, 1500, true)` for a loss: getStakeAtRisk = 0, no NRN moved to _stakeAtRiskAddress.
5. Compare against staking 4e18 wei: win gives 1500 points, loss risks 0.004 NRN.
**How found:** Code reading of _getStakingFactor's round-up-to-1 branch combined with _addResultPoints rounding curStakeAtRisk down; noticed the asymmetry between upside (factor 1) and downside (0.1% of 1 wei = 0).
**Exploitation:** Attacker stakes the minimum 1 wei NRN per fighter. On wins they accrue reward points equal to a near-4-NRN staker (stakingFactor 1); on losses the 0.1% curStakeAtRisk rounds down to zero, so no stake is ever forfeited. Repeated across many fighters, this farms reward points with negligible capital at risk.
**Escalation:** Scale by registering many fighters each staked 1 wei to farm reward points risk-free.
**Insight:** When a protocol rounds one quantity up and a related penalty down, look for the smallest input where the rounded-up value is non-zero but the rounded-down penalty is zero — that boundary is the exploit.