TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Unrestricted access to `getDealerCards` function enables cheating.

oxenzo

Description:

https://github.com/Cyfrin/2024-11-TwentyOne/blob/a4429168302722d14a5e5996d25d6fc5be22a899/src/TwentyOne.sol#L181

The getDealerCards function exposes the dealer's full hand to any user at any time. This undermines the randomness and unpredictability of the dealer's behavior, enabling players to make decisions with complete knowledge of the dealer's current state.

Impact:

Players gain a significant edge by knowing the dealer's hand in real-time.

Proof of Concept:

  • A player can call the getDealersCards function to analyze the dealers hand and adapt their gameplay tuning the chances of the dealer ending up being griefed with a bust.

Tools Used:

Manual Review.

Recommended Mitigation:

Access Control: Restrict access to getDealerCards to authorized entities(e.g only the contract owner or the admin).

​
function getDealerCards(address player) public view returns (uint256[] memory) {
+ require(msg.sender == owner, "Access denied");
return dealersDeck[player].dealersCards;
}
​
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.