TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

The require statement in `TwentyOne::startGame` has its condition too wide, this could cause players to lose their funds

uddercover

Summary

startGame has a require statement that demands that the value sent be more than or equal to 1 ether. This means that a player is allowed to send more than one ether which should not be the case, this could cause players to lose any extra value they send when starting a game.

function startGame() public payable returns (uint256) {
address player = msg.sender;
@> require(msg.value >= 1 ether, "not enough ether sent");
initializeDeck(player);
uint256 card1 = drawCard(player);
uint256 card2 = drawCard(player);
addCardForPlayer(player, card1);
addCardForPlayer(player, card2);
return playersHand(player);
}

Vulnerability Details

  1. A player accidentally sends 10 ether to start a game.

  2. The player cannot get their ether back.

  3. If the player is lucky, they may win the game and get only 2 ether back.

Proof of Code:

Place the below code into TwentyOneTest in TwentyOne.t.sol

function testPlayerCanSendMoreThanOneEther() public {
uint256 initialPlayerBalance = player1.balance;
​
//Call startGame as player1 with 10 ether value
vm.startPrank(player1);
twentyOne.startGame{value: 10 ether}();
​
//Player calls, is lucky and wins
twentyOne.call();
​
//Player only gets the 2 ether payout, they have lost 8 ether
uint256 finalPlayerBalance = player1.balance;
console.log("Initial player balance", initialPlayerBalance);
console.log("Final player balance: ", finalPlayerBalance);
​
assertGt(initialPlayerBalance, finalPlayerBalance);
vm.stopPrank();
}

Impact

Players who accidentally send more than one ether when starting a game would lose all the extra value.

Tools Used

Foundry suite

Recommendations

Consider making the require conditions more exact to equal one ether.

function startGame() public payable returns (uint256) {
address player = msg.sender;
- require(msg.value >= 1 ether, "not enough ether sent");
+ require(msg.value == 1 ether, "not enough ether sent");
.
.
.
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] User mistake, too much ETH sent

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.