# Fighter created by mintFromMergingPool can have arbitrary weight and element

MergingPool.claimRewards passes unvalidated customAttributes to mintFromMergingPool, letting winners mint fighters with arbitrary weight/element (0 or 2^256-1), breaking battle mechanics.

- Payout: Contest reward
- Severity: medium
- Program: AI Arena
- Credited: ktg
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-ai-arena-findings/issues/932
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-03
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** FighterFarm.mintFromMergingPool / MergingPool.claimRewards (Solidity)
**Root cause:** mintFromMergingPool forwards caller-supplied customAttributes directly into _createNewFighter without range-checking weight and element, unlike other mint paths.
**Steps:**
1. Win a MergingPool round so claimRewards is callable.
2. Call `claimRewards(modelURIs, modelTypes, customAttributes)` with `customAttributes[i] = [0, type(uint256).max]` or `[type(uint256).max, 0]`.
3. Observe minted fighter via `getAllFighterInfo` returns weight=2^256-1/element=0 or weight=0/element=2^256-1.
**How found:** Code reading of claimRewards -> mintFromMergingPool -> _createNewFighter path noticing customAttributes is user-controlled and never validated, unlike other mint functions.
**Exploitation:** A round winner claims rewards with crafted customAttributes, minting fighters with extreme weight (unknockbackable) or out-of-range element, gaining unfair advantage in AI Arena battles.
**Insight:** When a protocol has multiple mint paths, compare validation across them: the path that accepts user-supplied attributes (merging pool rewards) often skips the range checks the primary mint enforces.