TwentyOne

Description:

https://github.com/Cyfrin/2024-11-TwentyOne/blob/a4429168302722d14a5e5996d25d6fc5be22a899/src/TwentyOne.sol#L104
https://github.com/Cyfrin/2024-11-TwentyOne/blob/a4429168302722d14a5e5996d25d6fc5be22a899/src/TwentyOne.sol#L165

The current implementation of the endgame function introduces a vulnerability where the dealer is griefed if the player surpasses the hand value threshold of 21 by calling the hit function. Specifically:

If the player’s total hand value exceeds 21, the game logic marks the player as having lost (playerWon set to false).

However, no mechanism rewards the dealer in this scenario, leaving the dealer with no compensation even when the player busts. This behavior is outlined in the endgame function:

• L104: The playerWon condition determines if the player's balance is increased.

• L165: No reward transfer occurs to the dealer if the player loses, even though they have forfeited their bet.

This creates an imbalance, as the dealer receives no benefit when the player busts, effectively rendering the dealer's participation in the game disadvantageous.

Impact:

The absence of a reward for the dealer when the player busts leads to the following critical issues:

a. Economic Imbalance:

The dealer bears the risk of the game but is not rewarded when the player loses due to exceeding 21.
This could discourage dealers from participating in the game, undermining its viability.

b. Griefing Opportunity:

A malicious player can intentionally "bust" (surpass 21) repeatedly to grief the dealer, causing operational and financial strain without incurring meaningful consequences.

c. Loss of Incentive:

Dealers lose the primary incentive to participate in games, as the current logic fails to fairly distribute rewards when players make errors.

Proof of Concept:

Place this in the TwentyOne.sol test suite.

This are the logs that were outputted::

From the above logs. Once the endgame function has been called when the player went bust. The funds that the player used to start the game is locked entirely in the contract since there is no handling of rewards if the player went bust.

Tools Used:

Manual Review and Foundry.

Recommended Mitigation:

Add an else block in the endgame function to facilitate the rewarding of the dealer if the player goes bust.