TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Function `dealersHand()` in `TwentyOne.sol` incorrectly updates `dealerTotal` when `cardValue == 0`, adding 0 instead of 10.

CraSello Audits

Summary

Function dealersHand() in TwentyOne.sol incorrectly handles the case where the cardValue is 0 . Instead of treating it as a high-value card worth 10, it incorrectly adds 0 to the dealer's total, leading to miscalculations in the dealer's hand total.

Vulnerability Details

In the dealersHand() function, the following code calculates the dealer's hand total:

function dealersHand(address player) public view returns (uint256) {
uint256 dealerTotal = 0;
for (uint256 i = 0; i < dealersDeck[player].dealersCards.length; i++) {
uint256 cardValue = dealersDeck[player].dealersCards[i] % 13;
if (cardValue >= 10) {
dealerTotal += 10;
} else {
dealerTotal += cardValue;
}
}
return dealerTotal;
}

The issue lies in the lack of a condition to handle cardValue == 0. When a card's modulo operation results in 0 , it is incorrectly added as 0 instead of 10. The logic assumes all valid cardValues will be non-zero, which is not the case.

Impact

  • Miscalculation in dealersHand: The dealer's hand may be significantly lower than it should be, leading to an unfair advantage for the player.

Tools Used

  • Manual code review.

Recommendations

Add the cardValue == 0 condition in the if statement that updates the dealerTotal

function dealersHand(address player) public view returns (uint256) {
uint256 dealerTotal = 0;
for (uint256 i = 0; i < dealersDeck[player].dealersCards.length; i++) {
uint256 cardValue = dealersDeck[player].dealersCards[i] % 13;
if (cardValue == 0 || cardValue >= 10) {
dealerTotal += 10;
} else {
dealerTotal += cardValue;
}
}
return dealerTotal;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Asymmetric calculation of hands is rigged in the player`s favor.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.