TwentyOne

https://github.com/Cyfrin/2024-11-TwentyOne/blob/a4429168302722d14a5e5996d25d6fc5be22a899/src/TwentyOne.sol#L175

The getPlayerCards function allows any user to view the full hand of any player currently in the game. This unrestricted access to sensitive game state information compromises the integrity of the gameplay, as it allows malicious actors to exploit the data for strategic manipulation or collusion.

Impact:

Players can view each other's hands and coordinate strategies to exploit the dealer.

Proof of Concept:

1. A malicious player identifies an opponent's address during gameplay.

2. The malicious player calls the getPlayerCards function to retrieve the opponent's full hand.

3. The malicious player analyzes the retrieved opponentHand to determine the total value of the cards.

4. The malicious player gains an unfair advantage by knowing all possible outcomes based on the opponent’s hand, undermining the gameplay.

Tools Used:

Manual Review.

Recommended Mitigation:

Restrict access: Limit the getPlayerCards function to allow only the player themselves to view their hand.